Machine learning system for determining a security vulnerability in computer software

An apparatus, comprising:

• a processor;
• a memory unit storing computer-executable instructions, which when executed by the processor, cause the apparatus to:
• retrieve, from an industry standard scoring system and by a computing device and for a vulnerability, a temporal score based on a pre-revision version of the scoring system;
• predict, based on a machine learning model and based on the temporal score based on the pre-revision version of a scoring system, an updated temporal score based on a post-revision version of the scoring system, and train the machine learning model to predict the updated temporal score;
• determine, by a computing device and for a vulnerability, a mitigating factor score, wherein the mitigating factor score is indicative of a mitigation applied to the vulnerability by an enterprise organization, wherein the mitigating factor score is increased responsive to a determination that the mitigation is able to automatically be rolled out to enterprise assets of the enterprise organization and decreased otherwise, and wherein the mitigation factor score is increased responsive to a determination that the mitigation is irreversible and decreased otherwise;
• generate, by the computing device and for the vulnerability, a risk score, wherein the risk score is a composite of the updated temporal score and the mitigating factor score, and wherein the risk score is decreased when the mitigation factor score is increased based on an exponential decay value of the mitigation factor score;
• determine, based on the risk score for the vulnerability, an enterprise risk score for the enterprise organization, wherein the enterprise risk score is an aggregate of risk scores for vulnerabilities in a collection of vulnerabilities, and wherein the collection of vulnerabilities is indicative of vulnerabilities associated with the enterprise organization;
• automatically roll out the mitigation applied to the vulnerability to one or more of the enterprise assets of the enterprise organization, wherein automatically rolling out the mitigation comprises applying a patch for release for the vulnerability to the one or more of the enterprise assets such that the enterprise risk score is decreased with application of the patch;
• and
• display, via a graphical user interface, the enterprise risk score as decreased after application of the patch to the one or more of the enterprise assets.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing device, cause the computing device to:

• retrieve, from an industry standard setting scoring system and by a computing device and for a vulnerability, a temporal score based on a pre-revision version of a scoring system;
• predict, based on a machine learning model and the temporal score based on the pre-revision version and by the computing device and for the vulnerability, an updated temporal score based on a post-revision version of the scoring system, and train the machine learning model to predict the updated temporal score;
• determine, by the computing device and for the vulnerability, a mitigating factor score, wherein the mitigating factor score is indicative of a mitigation applied to the vulnerability by an enterprise organization, and wherein the mitigating factor score is based on (1) an effectiveness measure indicative of a success of the mitigation, (2) a completeness measure indicative of a percentage of total enterprise assets that the mitigation has been applied to, and (3) an enforcement measure indicative of a success in enforcing the mitigation, wherein the mitigating factor score is increased responsive to a determination that the mitigation is able to automatically be rolled out to enterprise assets of the enterprise organization and decreased otherwise, and wherein the mitigation factor score is increased responsive to a determination that the mitigation is irreversible and decreased otherwise;
• generate, by the computing device and for the vulnerability, a risk score, wherein the risk score is a composite of the updated temporal score and the mitigating factor score, and wherein the risk score is decreased when the mitigation factor score is increased based on an exponential decay value of the mitigation factor score;
• determine, based on the risk score for the vulnerability, an enterprise risk score for the enterprise organization, wherein the enterprise risk score is an aggregate of risk scores for vulnerabilities in a collection of vulnerabilities, and wherein the collection of vulnerabilities is indicative of vulnerabilities associated with the enterprise organization;
• and
• automatically roll out the mitigation applied to the vulnerability to one or more of the enterprise assets of the enterprise organization, wherein automatically rolling out the mitigation comprises applying a patch for release for the vulnerability to the one or more of the enterprise assets such that the enterprise risk score is decreased with application of the patch;
• and
• display, via a graphical user interface, the enterprise risk score as decreased after application of the patch to the one or more of the enterprise assets.