Cybersecurity risk calculation and reporting model

A method for reporting a cybersecurity risk level to an organizational group of a business, said method comprising:

• computing a current cybersecurity risk level of the organizational group using a risk level calculation model which runs on a computing device and computes the current cybersecurity risk level based on inputs including a list of vulnerability severities for the organizational group and a cybersecurity history parameter for the organizational group, where the model computes the current cybersecurity risk level by multiplying a first weight factor by a sum of the vulnerability severities and adding a second weight factor multiplied by the cybersecurity history parameter;
• when the current cybersecurity risk level of the organizational group does not exceed a threshold, transmitting the current cybersecurity risk level to the organizational group;
• when the current cybersecurity risk level of the organizational group exceeds the threshold, identifying a set of proposed security-related fixes for the organizational group, computing a predicted cybersecurity risk level of the organizational group using the model with the set of proposed security-related fixes, the list of cybersecurity vulnerability severities and the cybersecurity history parameter, and reporting the current and predicted cybersecurity risk levels along with a restricted change implementation status to the organizational group;
• and
• using the current and predicted cybersecurity risk levels of the organizational group in a feature freeze change management process, wherein the current and predicted cybersecurity risk levels of the organizational group are considered in determining whether a feature-enhancing change to an application or system is approved for implementation.

A cybersecurity reporting system, said system comprising:

• a computer having a processor and memory, and non-transitory computer readable media configured to perform steps including;
• computing a current cybersecurity risk level of an organizational group of a business using a risk level calculation model, where the model computes the current cybersecurity risk level based on inputs including a list of vulnerability severities for the organizational group and a cybersecurity history parameter for the organizational group, and the model computes the current cybersecurity risk level by multiplying a first weight factor by a sum of the vulnerability severities and adding a second weight factor multiplied by the cybersecurity history parameter;
• and
• when the current cybersecurity risk level of the organizational group does not exceed a threshold, transmitting the current cybersecurity risk level to the organizational group.