## 2 Background and Related Works
### Cyber Threat Intelligence and Cyber Risk Management Integration  
Multiple works have already proposed new cyber risk assessment models considering cyber threat assessment. EBIOS [21] defines cyber threat actors as risk origins and accounts for their strategic and operational attack paths based on the scope without concrete consideration for cyber threat intelligence information and its continuous flow. In [43], the authors proposed a hybrid model that integrates threat assessment in the risk assessment  
Figure 2: Cyber threat intelligence process.  
process to optimize the risk assessment results better. Their approach was motivated by closing the gap of the need for systematic threat assessment in the risk assessment process. They proposed a new hybrid risk assessment model with threat assessment placed after the vulnerability identification. Thus, the risk assessment results are driven by the identified weaknesses inside the assessed scope, not threats' motives and capabilities, and without support for cyber threat intelligence output. This process can be enhanced by driving the risk assessment by the threat characteristics and improving its results to match realistic scenarios. In [44], the authors extended the work of [43] by introducing MITRE ATT&CK [37] as an approach to build and assess attack scenarios. In [45], the authors propose another hybrid and dynamic risk analysis methodology for cyber-physical systems leveraging well-established sources for threat information for risk analysis with a proof of concept implementation. However, the described methodology does not account explicitly for cyber threat intelligence information and accounts only for vulnerabilities and threat correlation. In [46], a framework is proposed to utilize the MITRE ATT&CK knowledge base in the risk assessment to provide sufficient evidence during the development lifecycle. The framework describes workflows to create strategic, operational, and technical scenarios based on the EBIOS methodology, with explicit consideration for cyber threat intelligence and its continuous information feeds. In [47], the authors highlighted the need for more consideration of cyber threat intelligence in cyber risk management. Countering emerging cyber threats is becoming more challenging for current cyber risk management. A new unified model to assess cyber risks is proposed with cyber threat intelligence integration. However, the model presents a means to determine the necessary risk parameters without a straightforward, systematic process and continuous approach. In [48], the authors established a nationwide risk assessment framework based on vulnerability management and threat intelligence, focusing only on inventorying software and cross-matching with vulnerabilities. Finally, in [49], the authors proposed a novel threat intelligence-based security assessment method without explicitly focusing on risk management and offering a complete risk management framework. Table 1 presents the main differences between the relevant frameworks, considering cyber threat assessment and intelligence in terms of novelty, risk assessment, threat assessment, risk and threat monitoring, integration of cyber threat intelligence, type of cyber threat intelligence considered, and the ability to adjust the risks based on new threat intelligence.  
While existing efforts have contributed significantly to integrating threat assessment into risk assessment, existing models often lack a systematic, continuous approach to incorporating cyber threat intelligence. Therefore, such a framework is still non-existent. To address this, our research proposes novel enhancements and modifications to a cyber risk management framework to integrate cyber threat intelligence. By considering EBIOS Risk Manager as our base process, we aim to bridge the knowledge gaps between attackers and defenders, leading to more informed and adaptable risk assessments and mitigation prioritization.