Scalable Cyber-Risk Assessment Through Non-Intrusive Asset Discovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-risk assessment technologies face challenges in scaling risk quantification for a large number of entities due to manual data gathering and subjective information, which is inefficient and time-consuming, especially for third-party risk management.
Innovation Solution
A non-intrusive data gathering method using publicly and privately accessible data sources to collect technical data for scalable cyber-risk assessment, employing asset discovery, cyber intelligence scanning, and risk quantification systems to provide quantitative risk values without human intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual data gathering methods are used for cyber-risk assessment, then data accuracy can be maintained through human judgment, but the assessment process becomes time-consuming and cannot scale to large numbers of entities
Solution Approach 1:
The patent uses automated scanning tools to create digital copies of security control data from multiple sources (public records, private data feeds, vulnerability databases). These copied data sets are then processed and merged algorithmically to produce risk assessments at scale without manual intervention for each entity
Solution Approach 2:
The patent replaces manual mechanical data gathering processes with automated electronic scanning and data collection systems. Multiple data feeds and scanning tools automatically collect, merge, and process security control information, substituting human manual work with automated computational processes
2Loss of information
If subjective information is collected from entities, then contextual understanding can be obtained, but the assessment becomes inefficient and requires significant human intervention
Solution Approach 1:
The patent implements a universal data collection framework that gathers multiple types of security control information through automated scanning from various sources (public records, private data feeds, vulnerability databases). This multi-functional system replaces the need for entity-specific subjective responses by universally collecting objective data across all assessed entities
Solution Approach 2:
The system enables entities to be assessed through automated data collection from publicly available sources and private data feeds without requiring active participation or subjective input from the entities themselves. The scanning tools automatically gather necessary information, making the assessment process self-service oriented
3Reliability
If comprehensive security control data is gathered from multiple sources, then assessment accuracy improves, but system complexity and data processing requirements increase
Solution Approach 1:
The patent segments the complex data collection and processing task into distinct modular components: multiple independent data feeds (public records, private feeds, vulnerability databases), separate scanning tools for different data types, and modular processing steps (data collection, merging, analysis). This segmentation allows comprehensive data gathering while managing system complexity through modular architecture
Solution Approach 2:
The patent introduces intermediary processing layers that mediate between multiple data sources and the final assessment output. These intermediaries include automated data merging algorithms, validation layers, and processing rules that standardize and reconcile data from diverse sources, reducing the complexity of integrating comprehensive security control information
Data Source
AI summary
A method of displaying a cyber risk assessment includes receiving a request for a quantitative cyber risk assessment of an entity associated with a domain name. A digital footprint of the entity is discovered based on the domain name using non-intrusive information gathering. An entity classification is determined based on the digital footprint. An entity technical finding is determined. A loss event frequency is computed using the entity classification and the entity technical finding. A loss magnitude is computed using the entity classification and the entity technical finding. A probable financial impact of a cyber risk based on the loss event frequency and on the loss magnitude is computed. Recommendations for remediating the cyber risk based on the computed probable financial impact is displayed.