# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 5 Discussion
### Limitations of DRA Models and Challenges  
Our research revealed a noteworthy limitation among the majority of proposed models, i.e., their deficiency in proactive capabilities due to the limited integration of CTI-related information. DRA models primarily focus on real-time data concerning ongoing activities within an organisation's environment, typically sourced from systems like an IDS. Embedding proactive functionality within these DRA frameworks holds substantial potential for enhancing organisations' security postures by enabling proactive threat preparedness. The significance of CTI knowledge has been underscored as a pivotal instrument for proactive cyber risk mitigation [72]. By integrating relevant CTI data, such as information on recently discovered vulnerabilities and emerging threats, DRA models are capable of proactively reassessing the existing risk level.  
A similar limitation illuminated by our research reveals that a significant majority of DRA models do not harness historical data or incorporate past events into their analyses; instead, they predominantly concentrate on monitoring ongoing activities. This dearth of historical context within DRA modelling can hinder their ability to derive valuable insights from past incidents, potentially leading to a less comprehensive understanding of threat dynamics.  
Our research substantiates that DRA models rely on a wide range of data sources for input. Distributed data fusion, a process involving the integration and analysis of information from diverse data sources, emerges as a pivotal method for achieving a comprehensive and precise understanding of a given environment or system. Within the domain of DRA models, the attainment of real-time and precise results assumes paramount significance. The utilisation of data fusion techniques has demonstrated effectiveness in various applications. The LLPTE scheme [73] can improve DRA models to amalgamate disparate, inconsistent, uncertain, or even redundant data. Additionally, this framework for threat intelligence extraction and fusion [74] can provide DRA models assistance in correlating and unifying data. By employing these techniques, DRA models can enhance the quality of input data assimilated, leading to more consistent and accurate outcomes.  
In addition to data fusion, the incorporation of trust evaluation techniques can further enhance the accuracy and precision of fused results [73]. Trust evaluation techniques assume an even more critical role when contemplating the deployment of DRA models within a zero trust environment (ZTA). In such a context, DRA models are tasked with processing  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Maturity Level** & **3** & **2** & **1** \\ \hline \# DRA models & 38 & 8 & 4 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Number of models to each maturity Level.  
substantial volumes of data, serving as input for real-time risk-based decision making. Given the diverse array of data sources, including untrusted and even potentially malicious ones, the utilisation of trust evaluation techniques by DRA models can enhance their trustworthiness. Trust evaluation methods, such as TFL-DT [75], have demonstrated their efficacy in identifying malicious users and should be adopted by DRA models. In addition, trust evaluation models can also be used not only to identify malicious users (data sources) but also to quantitatively evaluate the source of information [76] in order to increase even further the accuracy and preciseness of the data used as input by DRA models.  
Future DRA models should prioritise the development of effective operations within a ZTA environment, giving due consideration to both data fusion and trust evaluation schemes. These techniques will enhance the quality of input data, a significance that becomes even more pronounced in a ZTA environment, enabling DRA models to produce accurate and precise results while upholding the imperative of delivering real-time outcomes.