## 1 Introduction  
In the rapidly evolving landscape of cybersecurity, organizations confront an escalating array of threats, including advanced persistent threats (APTs), zero-day exploits, and large-scale distributed denial-of-service (DDoS) attacks. These threats are dynamic, adaptive, and increasingly sophisticated, exposing the limitations of traditional risk assessment methods in ensuring system security and operational continuity. Conventional approaches, such as point-in-time risk scoring and mean time between failures (MTBF), focus on static snapshots of system vulnerabilities. This means they cannot quantify critical dynamic processes like recovery and learning, nor can they measure intrinsic capabilities such as Destruction Resistance and adaptability. This gap leaves systems susceptible to cascadingfailures, prolonged downtimes, and inadequate responses to evolving adversarial tactics. Consequently, there is an urgent need for a new paradigm that not only evaluates a system's ability to withstand and recover from attacks but also captures its capacity for continuous adaptation and improvement in the face of persistent and unpredictable threats. Indeed, the ultimate goal of such resilience is to ensure that these digital infrastructures can continue to function as reliable enablers of innovation, entrepreneurship, and societal progress [1]. To address these challenges, cybersecurity resilience has emerged as a pivotal concept. Unlike traditional security metrics that emphasize Prevention or risk mitigation, resilience focuses on a system's ability to sustain core functions under adversarial pressure, recover swiftly from disruptions, and evolve through learning from past incidents. A resilient system anticipates threats, absorbs damage, restores functionality, and adapts its defenses over time. However, it remains challenging to quantify resilience in a dynamic, measurable, and actionable way. This difficulty arises from the complex interplay between preventive, defensive, recovery, and evolutionary capabilities, which is further complicated by unpredictable adversarial behavior and environmental changes. This paper proposes a novel theoretical model for assessing Cybersecurity Resilience Capacity (RC), accompanied by a practical, operational four-dimensional evaluation framework named P-R-A-L, which stands for Prevention (P), Destruction Resistance (R), Adaptive Recovery (A), and Evolutionary Learning (L). Unlike static risk models, the RC model transforms resilience into a time-evolving trajectory, capturing the nonlinear interactions between defensive and evolutionary capabilities while accounting for real-time variations in environmental threat entropy. The complementary P-R-A-L framework (as shown in Figure 1) is designed to achieve actionable implementation, leveraging mature technologies to ensure feasibility and practicality in real-world systems. By aligning with established cybersecurity standards such as the NIST Cybersecurity Framework 2.0 [2], NIST SP 800-37 [3], GB/T 44862-2024 [4], and the MITRE ATT&CK threat taxonomy [5], our approach integrates seamlessly with existing practices while offering a forward-looking perspective on resilience measurement. The primary contributions of this work are as follows. First, we introduce a mathematical model for cybersecurity resilience that quantifies system capabilities across the threat response continuum using a closed-loop structure for continuous assessment and adaptation. Second, we develop a dynamic constraint mechanism to incorporate environmental threat entropy variation, reflecting the real-time complexity of adversarial environments.