System and method for scalable cyber-risk assessment of computer systems

A system for cyber risk assessment, the system comprising:

• a) a processor coupled to a network that generates and populates a knowledge database with control items using information non-intrusively gathered from a plurality of data sources on the network;
• b) a computer interface that receives a request for a quantitative cyber risk assessment of an entity associated with a domain name assessable on the network;
• c) a processor coupled to the network that non-intrusively gathers entity information associated with the domain name from a plurality of data sources on the network;
• d) a processor coupled to the network that discovers a digital footprint of the entity based the associated domain name using non-intrusive information gathering;
• e) a processor that classifies at least one characteristic of the entity to determine an entity classification having entity risk quantification parameters comprising at least two of a country of the entity, a size of the entity, or an industry of the entity;
• f) a processor that fetches at least one control item from the knowledge database and that determines an entity technical finding based on the fetched at least one control item and based on the discovered digital footprint;
• g) a processor that fetches from a database at least one industry-related quantification parameter based on the entity technical finding and based on the entity classification and then computes a loss frequency and a loss magnitude using the entity technical finding, the entity risk quantification parameter, and the industry-related quantification parameter and then computes a probable financial impact based on the loss frequency and the loss magnitude as a parameter that quantifies a cyber risk caused by at least one of an asset vulnerability, a threat, a data loss or a cyber event;
• and
• h) a processor that remediates the at least one of the asset vulnerability, the threat, the data loss or the cyber event.

A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations that determine a cyber risk assessment to a company, the operations comprising:

• a) populating a knowledge database with control items generated using non-intrusively gathered control information from a plurality of data sources;
• b) receiving a request for a quantitative cyber risk assessment of an entity associated with a domain name;
• c) non-intrusively gathering entity information from a plurality of data sources about the entity based on the domain name using computer resources;
• d) discovering a digital footprint of the entity based the associated domain name using non-intrusive information gathering;
• e) classifying using computer resources at least one characteristic of the entity to determine an entity classification having entity risk quantification parameters comprising at least two of a country of the entity, a size of the entity, or an industry of the entity;
• f) fetching at least one control item from the knowledge database;
• g) determining an entity technical finding based on the fetched at least one control item and based on the discovered digital footprint;
• h) fetching from a database at least one industry-related quantification parameter based on the entity technical finding and based on the entity classification;
• i) computing a loss frequency and a loss magnitude using the entity technical finding, the entity risk quantification parameter, and the industry-related quantification parameter;
• j) computing a probable financial impact based on the loss frequency and the loss magnitude as a parameter that quantifies a cyber risk caused by at least one of an asset vulnerability, a threat, a data loss or a cyber event;
• and
• k) remediating the at least one of the asset vulnerability, the threat, the data loss or the cyber event.

A method of cyber risk assessment, the method comprising:

• a) populating a knowledge database with control items generated using non-intrusively gathered control information from a plurality of data sources;
• b) receiving a request for a quantitative cyber risk assessment of an entity associated with a domain name;
• c) non-intrusively gathering entity information from a plurality of data sources about the entity based on the domain name using computer resources;
• d) discovering a digital footprint of the entity based the associated domain name using non-intrusive information gathering;
• e) classifying using computer resources at least one characteristic of the entity to determine an entity classification having entity risk quantification parameters comprising at least two of a country of the entity, a size of the entity, or an industry of the entity;
• f) fetching at least one control item from the knowledge database;
• g) determining an entity technical finding based on the fetched at least one control item and based on the discovered digital footprint;
• h) fetching from a database at least one industry-related quantification parameter based on the entity technical finding and based on the entity classification;
• i) computing a loss frequency and a loss magnitude using the entity technical finding, the entity risk quantification parameter, and the industry-related quantification parameter;
• j) computing a probable financial impact based on the loss frequency and the loss magnitude wherein the quantitative risk value quantifies a cyber risk;
• and
• k) performing at least one of a remediation, an audit or a prioritization of third parties based on the cyber risk.