System and methods for vulnerability assessment and provisioning of related services and products for efficient risk suppression

A system for assessing cyber security vulnerability of an enterprise, comprising:

• processing circuitry;
• and
• a non-transitory computer readable medium having instructions stored thereon, wherein the instructions, when executed on the processing circuitry, cause the processing circuitry to
• obtain assessment data comprising information pertaining to a plurality of security domains of cybersecurity vulnerability of the enterprise,
• determine, for each security domain of the plurality of security domains associated with information technology systems of the enterprise, a respective domain-level vulnerability score based on the information of the assessment data pertaining to the respective security domain,
• identify, for at least one security domain of the plurality of security domains, one or more cyber security threats relevant to the enterprise based upon at least one of the domain-level vulnerability score and the assessment data pertaining to the respective security domain, wherein the one or more cyber security threats include attacks directed at one or more of the plurality of security domains,
• determine, for each security domain of the plurality of security domains, a benchmark vulnerability score representing an aspirational vulnerability score for the respective security domain, wherein
• the benchmark vulnerability score for the respective security domain is based on domain-level vulnerability scores for one or more peer enterprises sharing one or more attributes with the enterprise, and
• the benchmark vulnerability score is determined as a function of an amount of sensitivity of the respective security domain to the one or more cyber security threats, wherein the sensitivity represents an extent to which success of an attack from the one or more cyber security threats is dependent on a deficiency in a current level of protection of the respective security domain,
• prepare, for presentation to a representative of the enterprise at a remote computing device, a first graphical user interface for displaying the respective domain-level vulnerability score and corresponding benchmark vulnerability score for each of the plurality of security domains,
• identify, for each of the plurality of security domains with the respective domain-level vulnerability score that falls below the respective benchmark vulnerability score for the respective security domain, one or more recommended products or services for improving the respective domain-level vulnerability score to at least equal the respective benchmark vulnerability score,
• prepare, for presentation to a representative of the enterprise at the remote computing device, a second graphical user interface for selecting each of the one or more recommended products or services,
• receive, from the remote computing device through interaction with the second graphical user interface, selection of at least one product or service of the one or more recommended products or services, and
• responsive to receiving the selection,
• i) apply one or more adjusted values to the assessment data based upon the at least one product or service to obtain prospective assessment data, and
• ii) calculate, using the prospective assessment data, a prospective domain-level vulnerability score representing the vulnerability score in a respective security domain of the plurality of security domains impacted by application of the at least one recommended product or service, and
• iii) prepare, for presentation to the representative at the remote computing device, a third graphical user interface, comprising
• illustration of an improvement in vulnerability score between the vulnerability score of the respective security domain and the prospective domain-level vulnerability score of the respective security domain.