# US 12,003,544 B2 · System and methods for automatically assessing and improving a cybersecurity risk score

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,544 B2
- Document ID: US12003544B2
- Status: Granted
- Kind: B2
- Application number: 17/392,250
- Filed: 2021-08-02
- Published: 2022-02-24
- Granted: 2024-06-04
- Earliest claimed: 2015-10-28
- Assignees: Qomplx LLC
- Applicants: Qomplx LLC
- Inventors: Jason Crabtree; Andrew Sellers
- Web page: https://patentgrep.com/patent/US12003544B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 16/2477: {Temporal data queries}
- G06F 16/951: Indexing; Web crawling techniques
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for automatically assessing and improving a cybersecurity risk score, wherein a cybersecurity risk score and cyber-physical graph for a network are retrieved and analyzed to identify potential improvements that can be made to network topography and device configurations, changes are applied automatically and an updated cyber-physical graph reflecting the applied changes is produced, and the updated cyber-physical graph is reassessed to determine the effect of the changes that were applied.

## Claims

### Claim 1

A system for automatically assessing and improving a cybersecurity risk score, comprising:
a computing system comprising a memory, a processor, and a network interface;
a cybersecurity scoring subsystem comprising a first plurality of programming instructions that, when operating on the processor, cause the computing system to:
retrieve a cyber-physical graph for a network;
retrieve a cybersecurity profile for the network based on external reconnaissance of the network by a reconnaissance subsystem;
determine a cybersecurity risk score for the network based on the cybersecurity profile and the cyber-physical graph of the network;
provide the cybersecurity risk score and the cyber-physical graph to a directed computational graph subsystem;
upon changes occurring at one or more of a plurality of target devices, determine a new cybersecurity risk score and provide it to the directed computation graph subsystem;
the directed computational graph subsystem comprising a second plurality of programming instructions that, cause the computing device system to:
analyze the cyber-physical graph and the cybersecurity risk score; and
when the cybersecurity risk score falls below a threshold:
identify a plurality of changes that can be applied to each of the plurality of target devices within the network, the identified plurality of changes being based on results of the analysis;
transmit instructions to the plurality of target devices, wherein upon receipt of the instructions each of the plurality of target devices automatically applies at least one of the identified plurality of changes; and
update the cyber-physical graph based on the applied changes.

### Claim 2

A method for automatically assessing and improving a cybersecurity risk score, comprising the steps of:
retrieving a cyber-physical graph for the network;
retrieving a cybersecurity profile for the network based on external reconnaissance of the network by a reconnaissance subsystem;
determining a cybersecurity risk score for the network based on the cybersecurity profile and the cyber-physical graph of the network;
providing the cybersecurity risk score and the cyber-physical graph to a directed computational graph subsystem of a computing system;
upon changes occurring at one or more of a plurality of target devices, determining a new cybersecurity risk score;
analyzing, using the directed computational graph subsystem, the cyber-physical graph and the cybersecurity risk score; and
when the cybersecurity risk score falls below a threshold:
identifying a plurality of changes that can be applied to each of the plurality of target devices within the network, the identified plurality of changes being based on results of the analysis;
transmitting instructions to the plurality of target devices, wherein upon receipt of the instructions each of the plurality of target devices automatically applies at least one of the identified plurality of changes; and
updating the cyber-physical graph based on the applied changes.