# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 4 Results
### Unclassified
More than 50 equations are used to describe relationships between variables in the system and to produce the respective results (e.g., expected damage loss from a successful attack). The authors used two real companies as references, one with a low cybersecurity posture and one with high. Simulation results showed that even when the second company operated in a high-threat environment and the first in a low, the second company was much more resistant to cyber attacks, and hence expected damage loss from a cyber attack was lower. [PERSON] et al. [PERSON] et al. (2018) proposed AMBIENT, a model which is capable of handling both cyber and privacy risks within the same toolkit. The part that handles the cyber risk is the cyber risk assessment component, which gathers large volumes of cybersecurity-related data in real time and correlates them in order to assess the risk. The CORAS tool is used for graphical risk analysis, DEXi and fuzzy logic are used to produce qualitative results in terms of risk (likelihood, impact), while the R programminglanguage is used to produce quantitative reports in monetary terms. Afterwards, the appropriate counter-measures are proposed in order to reduce the risk. The model was tested using a real test-bed scenario considering the working environment of a hospital from the ICT perspective. The results of the test showed that the model was able to quantify risk in monetary terms, and also to provide effective mitigation measures. The efficacy of the proposed measures was validated by experts. [PERSON] et al. [59] presented a framework which enhances the cybersecurity of EPES infrastructure. The framework relies on a security information and event management system (SIEM) that detects and correlates diverse security events, utilising comprehensive input data from various sources such as IDSs and firewalls. Each security event is assigned a risk value derived from a predefined quantitative formula involving asset value, event priority, and event reliability. The RA module examines new energy-related cyber threats and vulnerabilities from various public repositories, such as CTI sharing modules and CVSS scores to compute risk values. [PERSON] et al. [60] recommended a risk evaluation methodology for life-critical embedded devices, including medical devices, named FIRE, which integrates both static and dynamic RA in order to produce quantitative results. This methodology also relies on CDFs which are used to define the static risk thresholds. The dynamic risk is based on the run-time risk determined by comparing the actual risk in each mode to the static risk thresholds. FIRE's effectiveness was demonstrated through a case study, demonstrating successful threat mitigation and achieving a 0% false-positive rate. [PERSON] et al. [61] proposed a quantitative DRA model for cyber attacks on CPSs, with a specific focus on power systems. The authors use probability distribution along with CDFs to model the skills of attackers, employ NVD data to identify vulnerabilities, and examine potential attack paths using attack graphs. The simulations showed that certain cyber attacks could cause serious impact on power systems, such as cascading failures and blackouts. [PERSON] et al. [62] introduced a dynamic risk propagation and evaluation approach, which predicts attacks and quantitatively analyses system's risk. This approach utilises a \"partitioned cellular automata\" model to handle variations amongst different parts of the CPSs. In addition, it takes as input information originating from an IDS. It comprises two modules: the offline, which is used for creating risk analysis models considering the impact of attacks; and the online, for the prediction of risk propagation and quantification of the risk. The effectiveness of the proposed approach was validated through a case study utilising a co-simulation platform that included communication control and electrical power networks. A tool named CyberSAGE was presented by [PERSON] et al. [63]. It consists of three main inputs:  
1.