Patent Document ID: 20130191919
Application ID: 13354181
Patent Flag: 0

Claim One:
1. A computer-implemented method, performed by data processing apparatus, comprising: identifying a standardized vulnerability score for a particular vulnerability in a plurality of known vulnerabilities, wherein the standardized vulnerability score indicates a relative level of risk associated with the particular vulnerability relative other vulnerabilities in the plurality of known vulnerabilities; determining a vulnerability detection score indicating an estimated probability that a particular asset possess the particular vulnerability; determining a vulnerability composite score for the particular asset to the particular vulnerability, wherein the vulnerability composite score is derived from the standardized vulnerability score and the vulnerability detection score; identifying a countermeasure component score, wherein the countermeasure component score indicates an estimated probability that a countermeasure will mitigate risk associated with the particular vulnerability on the particular asset; and determining a risk metric for the particular asset and the particular vulnerability from the vulnerability composite score and the countermeasure component score.