A computer-implemented method for mitigating cyber security risk of an enterprise network , the computer-implemented method being executed by one or more processors and comprising: obtaining generic ontology data (M2) representing classes, properties, and relations for multiple use cases; generating, from the generic ontology data, domain-specific ontology data (M1) representing classes, properties, and relations for a particular use case; and characterised in that it comprises: generating a knowledge graph (219; 225; 550; 600) by mapping the generic ontology data to the domain-specific ontology data, the knowledge graph including nodes (602; 604; 610; 620) and edges between the nodes, the nodes including asset nodes representing assets and process nodes representing processes; each edge representing a relation between nodes; determining, from the knowledge graph, an aggregated risk for a first process represented by a first process node, including: identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process based on relations between the first process node and asset nodes of the set of incoming nodes; and determining an indirect risk for the first process based on relations between the first process node and process nodes of the set of incoming nodes; and generating, based on the aggregated risk for the first process node, a mitigation recommendation including one or more actions for reducing the aggregated risk for the first process node. obtaining generic ontology data (M2) representing classes, properties, and relations for multiple use cases; generating, from the generic ontology data, domain-specific ontology data (M1) representing classes, properties, and relations for a particular use case; and generating a knowledge graph (219; 225; 550; 600) by mapping the generic ontology data to the domain-specific ontology data, the knowledge graph including nodes (602; 604; 610; 620) and edges between the nodes, the nodes including asset nodes representing assets and process nodes representing processes; each edge representing a relation between nodes; determining, from the knowledge graph, an aggregated risk for a first process represented by a first process node, including: identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process based on relations between the first process node and asset nodes of the set of incoming nodes; and determining an indirect risk for the first process based on relations between the first process node and process nodes of the set of incoming nodes; and identifying, for the first process node, a set of incoming nodes, each incoming node comprising an asset node or a process node and being connected to the first process node by a respective edge; determining a direct risk for the first process based on relations between the first process node and asset nodes of the set of incoming nodes; and determining an indirect risk for the first process based on relations between the first process node and process nodes of the set of incoming nodes; and generating, based on the aggregated risk for the first process node, a mitigation recommendation including one or more actions for reducing the aggregated risk for the first process node. <EOS>