## 3 Results
### Application of the K-Means Cluster Analysis Method to Create Groups of Similar IS Risks (Clusters)  
Clustering with k-means is a popular unsupervised machine learning technique used to group similar data points into clusters. Our data are in a format where each row represents a data point, and each column represents a feature. K-means is a numerical clustering algorithm and may not work well with categorical data without proper preprocessing. One of the critical steps in k-means is determining the number of clusters (K). We can use methods like the Elbow Method or Silhouette Score to help us choose an appropriate value for K. Figure 1 displays the Silhouette Score. Based on the plot, we chose the value of K where the Silhouette Score starts to plateau or peaks. This is often referred to as the \"elbow\" of the curve. Our Silhouette values are above average. Actually, the plot says that we have eight clusters. The range between 0.45 and 0.55 is very interesting: our line does not approach a smooth line. A non-smooth line of any clustering criterion, even if it is not horizontal, should be interpreted as \"the presence of clear clusters\". Once we have chosen the number of clusters (K), we can fit the k-means model to data. The visualization of clusters is described in Figure 2.  
Figure 1: Silhouette Score of clusters. This t-SNE (t-Distributed Stochastic Neighbor Embedding) visualization presents a two-dimensional representation of clusters related to information security risks. Each cluster is labeled and colored distinctly according to different types of risks such as assets, network, expectations, eavesdropping, identification, access, secure, and cryptography. Well-separated clusters that correspond to known categories or expected results based on domain knowledge indicate good model performance. Overlap or mixed clusters might suggest either mixed data characteristics or a need for tuning t-SNE parameters. For example, clusters labeled as \"assets\" and \"cryptography\" suggest that the dataset contains distinct groups where each group shares common characteristics about these specific types of risks. This visualization helps in identifying relationships between different risk types, understanding the distribution and density of the data, and identifying outliers or anomalies. Clusters can indicate areas where security resources need to be focused or where further analysis is required. This in-depth statistical analysis and explanation of the t-SNE visualization provides a solid foundation for understanding the underlying data structure, thereby enhancing the credibility and utility of the clustering in practical scenarios. This approach helps ensure that the insights derived from the visualization are based on sound statistical principles. Based on the results of information security risks clustering, we received eight distinct clusters: assets, network, expectations, eavesdropping, identification, access, secure, and cryptology. Performing hierarchical clustering with tokenized data and a TF-IDF matrix in JSON format involves several steps. Hierarchical clustering is a method for grouping similar data points into clusters based on their similarity or distance. We used a hierarchical clustering algorithm like agglomerative clustering to create a hierarchical clustering tree (dendrogram). To visualize the clusters, we chose a suitable threshold from the dendrogram to cut the tree and form clusters. This threshold depends on the problem and the level of granularity we want. The results of constructing a hierarchical dendrogram are described in Figure 3.  
Ensuring that the chosen distance metric appropriately reflects the similarities or differences in the data is critical for meaningful clusters. Standardizing or normalizing data can be crucial when variables have different scales, as it prevents variables with larger scales from dominating the distance calculations.