## 5 Discussion
### Risk Assessment Methods for Cyber Resilience
In the method they presented, the probability is determined using the likelihood of attack based on skills, preparation time, and defense system; the impact is calculated considering the potential damage to safety-critical systems; exposure is defined as the vulnerability of the system to being attacked; and recovery is measured through the system's ability to recover from an attack. The classification of risk assessment and management techniques for improving cyber resilience, as shown in Table 9, demonstrates a number of strategies tailored to fit specific organizational needs that range from relatively simple quantitative methods to quantitative scoring systems and specialized models. Each of the categories--quantitative, qualitative, hybrid, and specialized--has unique methodologies, applications, and competencies required. Quantitative methods are based on measurable parameters; they provide numerical risk estimations using various scoring criteria, such as probability, vulnerability, impact, and risk thresholds. For example, the PIM methodology, as cited in [22], uses a matrix format for assessing risks related to STRIDE classifications. Similarly, CVSS [117] is a standardized measure that allows for calculating the severity of vulnerabilities, and therefore quantifying and prioritizing security weaknesses. DREAD [9] estimates threats through multidimensional assessment to provide a holistic view of potential consequences. More sophisticated techniques, such as the CCE scoring method [116] and Tail Threshold Detection [20], offer greater precision by considering risk impact assessments and identifying thresholds for extreme events, respectively. Application of such quantitative approaches requires a certain level of statistical analysis skills and the ability to properly apply and interpret scoring models, which makes them particularly applicable in a data-intensive environment where numerical risk assessments are required. Qualitative approaches, on the other hand, are usually more flexible and adopted by small and medium-sized enterprises (SMEs) which face more strict resource constraints. The methods under this category depend on subjective judgments and often comprise techniques such as holding workshops, interviews, or expert judgments for data collection. The OCTAVE framework [130], for instance, is designed as a self-guided model, enabling organizational teams to carry out internal assessments of security strategies. OCTAVE-S is a variation for smaller organizations' needs; this version has a simpler framework of qualitative analysis. Holistic risk assessments [121] take interdependent risks into account, in particular cascading effects, while event tree analysis [39] systematically maps the potential consequences of events following the initial incidents. Qualitative methods are less technical, hence easier for resource-constrained organizations to undertake. They are, however, less precise compared to quantitative methods. Hybrid methods combine quantitative and qualitative approaches to build a holistic framework suitable for complex systems. Such methods are more suitable for large organizations where detailed risk assessments need to consider both statistical evidence and qualitative insights. For instance, SecRAM, developed under SESAR SWP16.2 [22], combines probability-impact assessments with the CIA triad, delivering a multi-faceted approach to cyber resilience. The TVRA [117] integrates threat and vulnerability assessment in order to improve the applicability of assessment in complex environments. PASTA [9] and TARA [101] concentrate on structured threat modeling methods to align technical risks with business objectives. Examples of other hybrid approaches are found through the combination of resilience phases and capability maturity assessments via the Cybersecurity Capability Maturity Model C2M2 [117], and the Five-Phase Resilience Assessment Framework [115].