# US 11,909,757 B2 · System and method for assessing cybersecurity risk of computer network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,757 B2 - Document ID: US11909757B2 - Status: Granted - Kind: B2 - Application number: 18/098,809 - Filed: 2023-01-19 - Published: 2023-05-18 - Granted: 2024-02-20 - Earliest claimed: 2017-08-08 - Assignees: American International Group, Inc. - Applicants: American International Group, Inc. - Inventors: Philip Kibler; Daniel Wilson; Martin Overton; Tracie Grella; Garin Pace - Web page: https://patentgrep.com/patent/US11909757B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for assessing cybersecurity risk of a computer network include the use of a risk model application that is configured to determine an initial cyber risk score value based upon an underwriting process. A cyber risk data stream is sent from the client's computer network to the system processor to periodically calculate an updated cyber risk score based upon actual data. The system processor is adapted to use the data stream to generate client information that is accessible by the client via a web-based client portal. In embodiments, the cyber risk data stream can be actively monitored to identify a threat of a cybersecurity breach. ## Claims ### Claim 1 A method comprising: receiving, by a processor, first input data corresponding to first operational characteristics of a computer network at a first time; determining, by the processor using a risk model, a first value of a first cybersecurity risk parameter based on the first input data of the computer network, wherein the first value is on a scale indicative of a cybersecurity risk level of the computer network receiving, by the processor, second input data corresponding to second operational characteristics of the computer network at a second time; determining, by the processor using the risk model, a second value of a second cybersecurity risk parameter based on the second input data of the computer network, wherein the second value is on the scale indicative of the cybersecurity risk level of the computer network; receiving, by the processor, third input data corresponding to third operational characteristics of the computer network at a third time; determining, by the processor using the risk model, a third value of a third cybersecurity risk parameter based on the third input data of the computer network, wherein the third value is on the scale indicative of the cybersecurity risk level of the computer network, wherein one or more application program interfaces (APIs) over the network translate the first input data, the second input data and the third input data into the risk model; in response to receiving a forecast request for a set of cybersecurity controls not present within the computer network, analyzing, by the processor, at least one of the first operational characteristics, the second operational characteristics or the third operational characteristics of the computer network modified by a configuration file through which the set of cybersecurity controls not present within the computer network is implemented in the computer network using the risk model, the analyzing being configured to determine a forecasted value of at least one of the first cybersecurity risk parameter, the second cybersecurity risk parameter or the third cybersecurity risk parameter; and generating, by the processor, risk score trend data of the computer network based upon at least two of the first value, the second value or the third value. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining, by the processor using the risk model, a threat likelihood value, a business impact value and a control effectiveness value based on the first operational characteristics of the computer network at the first time, wherein the business impact value is based on asset data associated with an operational configuration of the computer network, and wherein the control effectiveness value is based on how security controls reduce an implicit risk score; determining, by the processor, a product of the threat likelihood value and the business impact value; and deducting, by the processor, the control effectiveness value from the product to create a residual risk score for the first operational characteristics of the computer network at the first time. ### Claim 3 (depends on 2) The method of claim 2, further comprising updating, by the processor, the residual risk score. ### Claim 4 (depends on 1) The method of claim 1, wherein the first time, the second time and the third time are different times. ### Claim 5 (depends on 1) The method of claim 1, further comprising monitoring, by the processor, a data feed from a cybersecurity system installed within the computer network for a threat alert. ### Claim 6 (depends on 1) The method of claim 1, further comprising scoring, by the processor, a cyber risk based on information received from the computer network combined with threat intelligence and a potential impact of a cyber breach. ### Claim 7 (depends on 1) The method of claim 1, further comprising transmitting, by the processor, at least one of the first score, the second score or the third score to a client portal. ### Claim 8 (depends on 1) The method of claim 1, wherein the risk model includes a threat likelihood module, a business impact module, and a control effectiveness module. ### Claim 9 (depends on 1) The method of claim 1, further comprising determining, by the processor, a cyber risk maturity score. ### Claim 10 (depends on 1) The method of claim 1, wherein at least one of the first input data, the second input data or the third input data associated with the computer network are received via a data feed from a cybersecurity system installed within the computer network. ### Claim 11 (depends on 1) The method of claim 1, further comprising monitoring, by the processor, a data feed from a cybersecurity system installed within the computer network for a threat alert, and, in response to receiving the threat alert, transmitting an alert message to a client portal. ### Claim 12 (depends on 1) The method of claim 1, further comprising, in response to receiving an alert input concerning a cybersecurity threat, transmitting, by the processor, a threat alert message concerning the cybersecurity threat to a client portal independent of whether the cybersecurity threat is detected within the computer network. ### Claim 13 (depends on 1) The method of claim 1, further comprising selecting, by the processor, a cybersecurity control from a set of cybersecurity controls not present within the computer network, the selected cybersecurity control determined by calculating a relative effectiveness value for each of the set of cybersecurity controls and identifying a highest relative effectiveness value and transmitting data concerning the selected cybersecurity control to a client portal. ### Claim 14 (depends on 1) The method of claim 1, further comprising transmitting, by the processor, at least one of the risk score trend data or the forecasted value of the cybersecurity risk parameter to a client portal. ### Claim 15 (depends on 1) The method of claim 1, further comprising scoring, by the processor, a cyber risk based on information received from the computer network combined with current threat intelligence received from one or more data streams received through a web server and a potential impact of a cyber breach. ### Claim 16 (depends on 1) The method of claim 1, further comprising determining, by the processor, a cyber risk maturity score measured against a set of predetermined different attack patterns and across a set of selected asset groups. ### Claim 17 A method comprising: receiving, by a processor, first input data corresponding to first operational characteristics of a computer network at a first time; determining, by the processor using a risk model, a first value of a first cybersecurity risk parameter based on the first input data of the computer network, wherein the first value is on a scale indicative of a cybersecurity risk level of the computer network receiving, by the processor, second input data corresponding to second operational characteristics of the computer network at a second time; determining, by the processor using the risk model, a second value of a second cybersecurity risk parameter based on the second input data of the computer network, wherein the second value is on the scale indicative of the cybersecurity risk level of the computer network; receiving, by the processor, third input data corresponding to third operational characteristics of the computer network at a third time; determining, by the processor using the risk model, a third value of a third cybersecurity risk parameter based on the third input data of the computer network, wherein the third value is on the scale indicative of the cybersecurity risk level of the computer network, wherein one or more application program interfaces (APIs) over the network translate the first input data, the second input data and the third input data into the risk model; generating, by the processor, risk score trend data of the computer network based upon at least two of the first value, the second value or the third value; and monitoring, by the processor, a data feed from a cybersecurity system installed within the computer network for a threat alert, wherein the computer network implements a proactive measure configured to reduce the threat, in response to receiving the threat alert. ### Claim 18 A system comprising: a processor; and a tangible, non-transitory memory configured to communicate with the processor, the tangible, non-transitory memory having instructions stored thereon that, in response to execution by the processor, cause the processor to perform operations comprising: receiving, by the processor, first input data corresponding to first operational characteristics of a computer network at a first time; determining, by the processor using a risk model, a first value of a first cybersecurity risk parameter based on the first input data of the computer network, wherein the first value is on a scale indicative of a cybersecurity risk level of the computer network receiving, by the processor, second input data corresponding to second operational characteristics of the computer network at a second time; determining, by the processor using the risk model, a second value of a second cybersecurity risk parameter based on the second input data of the computer network, wherein the second value is on the scale indicative of the cybersecurity risk level of the computer network; receiving, by the processor, third input data corresponding to third operational characteristics of the computer network at a third time; determining, by the processor using the risk model, a third value of a third cybersecurity risk parameter based on the third input data of the computer network, wherein the third value is on the scale indicative of the cybersecurity risk level of the computer network, wherein one or more application program interfaces (APIs) over the network translate the first input data, the second input data and the third input data into the risk model; generating, by the processor, risk score trend data of the computer network based upon at least two of the first value, the second value or the third value; and monitoring, by the processor, a data feed from a cybersecurity system installed within the computer network for a threat alert, wherein the computer network implements a proactive measure configured to reduce the threat, in response to receiving the threat alert.