Cybersecurity Risk Calculation Model for Upgrade Freeze Decisions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Financial institutions lack a structured technique for evaluating and communicating cybersecurity risks associated with system changes, leading to potential introduction of new risks and lack of proactive measures when risk levels exceed thresholds.

Innovation Solution

A cybersecurity risk reporting methodology with a formalized calculation model that assesses organizational groups' risk levels, incorporating vulnerability and history data, and provides recommendations for security fixes to lower risk levels.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If system changes are implemented to improve functionality and adaptability, then productivity and versatility are improved, but cybersecurity risk levels increase

Engineering Contradiction:

Improvesystem adaptabilityVSAvoidcybersecurity risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary cybersecurity risk assessment before system changes are deployed. The risk assessment model evaluates potential vulnerabilities and risk levels associated with proposed changes, allowing the organization to take preventive action before implementing modifications that could introduce security risks.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system provides continuous feedback on cybersecurity risk levels associated with organizational groups and system changes. The risk assessment model generates reports that feed back into the change management process, enabling informed decisions about whether to proceed with, modify, or reject proposed system changes based on their security implications.

Inventive Principle:

Principle #23Feedback

2Reliability

If traditional security measures are maintained to ensure system security, then cybersecurity protection is improved, but system productivity and update speed decrease

Engineering Contradiction:

Improvesystem securityVSAvoidsystem update speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent changes the parameter of security assessment from binary (secure/not secure) to a graduated risk level scale. The risk assessment model calculates specific risk levels based on multiple factors including vulnerability severity, exploitation likelihood, and business criticality, allowing for more nuanced and efficient security decisions that balance protection with productivity.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The system applies differentiated security measures based on local risk characteristics of different organizational groups and system changes. Instead of uniform security restrictions, the risk assessment model identifies specific areas requiring enhanced security attention while allowing lower-risk areas to proceed with updates more quickly, optimizing both security and productivity.

Inventive Principle:

Principle #3Local quality

3Measurement precision

If comprehensive security assessments are conducted for all system changes, then cybersecurity risk detection is improved, but time consumption and operational complexity increase

Engineering Contradiction:

Improverisk detection accuracyVSAvoidassessment time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The risk assessment model implements partial assessment by focusing on the most critical risk factors and organizational groups with highest risk levels. Instead of exhaustive analysis of every single system change, the model prioritizes assessments based on risk severity, business criticality, and vulnerability importance, achieving effective risk detection with reduced time investment.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent segments the cybersecurity risk assessment into distinct components: organizational group risk levels, individual system change risk assessments, and aggregate institution-wide risk profiles. This segmentation allows for efficient processing and reporting at multiple levels, reducing overall assessment time while maintaining comprehensive coverage.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20260025399A1Cybersecurity risk calculation and reporting model

Publication Date: 2026.01.22 TRUIST BANK

AI summary

A cybersecurity risk reporting methodology for a bank's computer systems which includes a cybersecurity risk level calculation model. For each of the bank's organizational groups, the model is run on a periodic basis to calculate the cybersecurity risk level. Inputs to the calculation model include cybersecurity vulnerabilities and severities for each of the organizational group's applications and systems, along with a cybersecurity history rating for the group. The model calculates a cybersecurity risk level which is reported to the organizational group, along with an indication of whether the group's risk level exceeds a threshold which freezes the group's ability to implement feature-based application/system upgrades. Proposed security-related fixes may be provided as inputs to the model, which calculates a predicted cybersecurity risk level for the organizational group, allowing the group to identify what security fixes need to be implemented in order to lower the group's cybersecurity risk level below a threshold.