A computer-implemented method for mitigating cyber security risk of an enterprise network, the computer-implemented method being executed by one or more processors and comprising: obtaining generic ontology data representing classes, properties, and relations for multiple use cases; generating, from the generic ontology data, domain-specific ontology data representing classes, properties, and relations for a particular use case; and characterised in that it comprises: generating a knowledge graph (219; 225; 550; 600) by mapping the generic ontology data to the domain-specific ontology data, the knowledge graph including nodes (602; 604; 610; 620) and edges between the nodes, the nodes including asset nodes representing assets and process nodes representing processes; each edge representing a relation between nodes; determining, from the knowledge graph, an aggregated risk for a first process represented by a first process node, including: identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process based on relations between the first process node and asset nodes of the set of incoming nodes; and determining an indirect risk for the first process based on relations between the first process node and process nodes of the set of incoming nodes; and generating, based on the aggregated risk for the first process node, a mitigation recommendation including one or more actions for reducing the aggregated risk for the first process node. obtaining generic ontology data representing classes, properties, and relations for multiple use cases; generating, from the generic ontology data, domain-specific ontology data representing classes, properties, and relations for a particular use case; and generating a knowledge graph (219; 225; 550; 600) by mapping the generic ontology data to the domain-specific ontology data, the knowledge graph including nodes (602; 604; 610; 620) and edges between the nodes, the nodes including asset nodes representing assets and process nodes representing processes; each edge representing a relation between nodes; determining, from the knowledge graph, an aggregated risk for a first process represented by a first process node, including: identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process based on relations between the first process node and asset nodes of the set of incoming nodes; and determining an indirect risk for the first process based on relations between the first process node and process nodes of the set of incoming nodes; and identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process based on relations between the first process node and asset nodes of the set of incoming nodes; and determining an indirect risk for the first process based on relations between the first process node and process nodes of the set of incoming nodes; and generating, based on the aggregated risk for the first process node, a mitigation recommendation including one or more actions for reducing the aggregated risk for the first process node.