Indicator of compromise calculation system

One or more non-transitory computer-readable media collectively storing computer-executable instructions that, when executed with one or more processors, collectively cause computers to perform acts comprising:

• monitoring, a client interaction of a computing device operating within an enterprise network, the client interaction involving at least one of a change to a systems configuration file or a bypass of a communications channel;
• retrieving, from the computing device, Indicator of Compromise (IoC) metadata derived from the client interaction of the computing device on the enterprise network;
• analyzing the IoC metadata relative to data records of one or more malicious threats;
• identifying at least one malicious threat from the one or more malicious threats, based at least in part on analysis of the IoC metadata;
• retrieving a data record associated with the at least one malicious threat, the data record including a first point-in-time that the at least one malicious threat was reported active;
• determining, a time-period for which the at least one malicious threat is likely to remain active after the first point-in-time, based at least in part on the data record;
• determining a second point-in-time that corresponds to a likely expiration of the at least one malicious threat based at least in part on the first point-in-time and the time-period;
• generating a similarity score for the IoC metadata, based at least in part on analysis of the IoC metadata;
• performing a mitigation analysis of environmental criteria associated with the computing device using the data record that is maintained until an expiration of the second point-in-time, the environmental criteria including access restrictions of the computing device to the enterprise network;
• determining a vulnerability score for the at least one malicious threat, based at least in part on the similarity score and the mitigation analysis;
• and
• generating reporting data that includes at least the vulnerability score for the malicious threat.

A system comprising:

• one or more processors;
• memory coupled to the one or more processors, the memory including one or more modules that are executable by the one or more processors to:
• monitor a client interaction, on a computing device operating with an enterprise network, for Indicator of Compromise (IoC) metadata based at least in part on an IoC monitoring list, the client interaction involving at least one of a change to a systems configuration file or a bypass of a communications channel;
• analyze the IoC metadata relative to data records of one or more malicious threats;
• identify at least one malicious threat of the one or more malicious threats, based at least on the IoC metadata;
• retrieve, from a data repository, a data record associated with the at least one malicious threat, the data record including a first point-in-time that the at least one malicious threat was reported active;
• determine, a time-period for which the at least one malicious threat is likely to remain active after the first point-in-time, based at least in part on the data record;
• determine a second point-in-time that corresponds to a likely expiration of the at least one malicious threat based at least in part on the first point-in-time and the time-period;
• perform a mitigation analysis of environmental criteria associated with the computing device using the data record that is maintained until an expiration of the second point-in-time, the environmental criteria including access restrictions of the computing device to the enterprise network;
• determine a vulnerability score for the at least one malicious threat that numerically combines a severity of the malicious threat with mitigating environmental criteria, based at least in part on the mitigation analysis;
• and
• generate reporting data that includes at least the vulnerability score for the at least one malicious threat.