# A Dynamic Risk Assessment and Mitigation Model
## 7 Discussion and Limitations
This direct incorporation of predictive data renders our model genuinely proactive, enabling it to deliver forward-looking risk assessments. Two existing models utilize the CVE-CWE-CAPEC pathway: one for estimating the likelihood of threat occurrence [26] and another for threat modeling [27]. Our approach extends this functionality by offering targeted mitigation suggestions for each detected CVE. The tracing from CVE to CAPEC is a procedure that has been utilized by scholars [43; 44], ensuring qualitatively that the proposed mitigation strategies from CAPEC align with the identified CVEs. Furthermore, our model is the only one that actively references the CISA KEY Catalog to provide information on the status of detected vulnerabilities. As a result, it offers insights into the availability of clear remediation actions, such as vendor patches, or identifies whether an affected product has reached end-of-life and should be removed from the network. Vulnerability patching has been recognized as an effective method for reducing the attack surface [45] and minimizing risk [46]. In addition, by offering tailored estimates of a vulnerability's current severity level, our model enhances vulnerability prioritization, facilitating more effective resource allocation [47]. By integrating proactive capabilities with targeted mitigation recommendations based on CAPEC and CISA KEY Catalog, our approach enables organizations to reduce or mitigate estimated risks before a cyber incident occurs. This empowers organizations to adopt a proactive risk management strategy rather than relying solely on reactive measures. The significance of proactive controls in effective risk management has been emphasized in multiple studies [48; 49; 50]. With regard to the functionality of providing relative mitigation suggestions, our model is the only one that offers this capability, as no other DRA model includes such a feature. While we classify our work as a dynamic risk assessment model with enhanced functionalities rather than a dynamic risk management model, a comparison with an existing dynamic risk management model [29] highlights a key distinction in the scope of mitigation actions. The dynamic risk management model offers a broader range of mitigation measures, including system reboots, shutdowns, and access control modifications. However, these actions are primarily derived from predefined, organization-specific strategies. On the other hand, our model leverages trusted, cybersecurity-related open sources to inform mitigation actions, providing more informative guidance rather than prescriptive directives. A key limitation of the proposed model is its inability to perform risk assessments based on real-time attack evidence, as it relies exclusively on EPSS data, which are inherently proactive. Unlike other DRA models that incorporate real-time attack evidence from IDS or other sources, our model focuses on estimating the likelihood of exploitation over the next 30 days, assuming the organization becomes a target of the identified threats. Another limitation lies in the assumption that every identified vulnerability (CVE) can be exploited and that such exploitation inevitably leads to subsequent exploitations, which may not always hold true in practice. The exploitability of vulnerabilities is influenced by multiple factors, such as the capabilities of attackers [51], which are not considered in the current model. Moreover, expert validation would be valuable in refining the assessment of identified vulnerabilities, offering a more nuanced understanding of their real-world impact and potential consequences. Additionally, the CAPEC mitigation strategies provided by our model are sourced directly from the original CAPEC framework without modification. Consequently, these strategies serve as general guidance rather than tailored recommendations, as they do not take into account environment-specific factors that may influence their practical effectiveness.