# US 2020/0396241 A1 · Holistic computer system cybersecurity evaluation and scoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396241 A1 - Document ID: US20200396241A1 - Status: Published application - Kind: A1 - Application number: 16/836,717 - Filed: 2020-03-31 - Published: 2020-12-17 - Earliest claimed: 2015-10-28 - Assignees: Qomplx LLC - Applicants: QOMPLX, Inc. - Inventors: Jason Crabtree; Andrew Sellers - Web page: https://patentgrep.com/patent/US20200396241A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 16/2379: {Updates performed during online database operations; commit processing} - G06F 16/24578: {using ranking} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for holistic computer system cybersecurity evaluation and risk rating that takes into account the operation of the entire computer system environment comprising hardware, software, and the operating system. Not only are the hardware, software, and operating system evaluated separately for cybersecurity concerns, their interaction and operation as a whole are also evaluated and scored. The results of such analyses may be used, for example, by underwriters of cybersecurity insurance policies to determine policy terms and rates. ## Claims ### Claim 1 A system for holistic computer system cybersecurity evaluation and rating, comprising: a first computing device comprising a memory and a processor; a system analyzer comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the first computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the first computing device to: receive a system definition comprising a software definition, a hardware definition, and an operating system definition for a second computing device; identify a software function defined by the software definition and compare the function to a database of software functions to establish a software cybersecurity score; identify a hardware component defined by the hardware definition and compare the component to a database of components to establish a hardware cybersecurity score; and identify an operating system function defined by the operating system definition and compare the function to a database of operating system functions to establish an operating system cybersecurity score; and a scoring engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the first computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the first computing device to: generate a cybersecurity score for the second computing device based on a combination of the software cybersecurity score, hardware cybersecurity score, and operating system cybersecurity score. ### Claim 2 (depends on 1) The system of claim 1, wherein the software definition comprises source code for an application and the software cybersecurity score further comprises an analysis of the coding complexity of the source code. ### Claim 3 (depends on 1) The system of claim 1, wherein: the software definition comprises executable binary code for an application; the hardware definition comprises a specification for a processor of the second computing device; the operating system definition comprises executable binary code for an operating system; and the system further comprises a hardware emulator comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the first computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the first computing device to: emulate the operation of the second computing device on the first computing device; receive and install the operating system on the emulated second computing device; receive and install the application on the emulated second computing device; operate the application on the emulated second computing device using the operating system; extract a function of the application to use as the software function by analyzing the operation of the application on the emulated second computing device; extract a function of the operating system to use as the operating system function by analyzing the operation of the operating system on the emulated second computing device; analyze an operation of the second computing device by executing an operation on the emulated second computing device associated with a known hardware exploit to: determine whether the emulated second computing device is susceptible to the exploit; and update the hardware cybersecurity score using the determination. ### Claim 4 (depends on 1) The system of claim 1, wherein the cybersecurity score is adjusted to reflect a domain in which the computer system will be used. ### Claim 5 (depends on 1) The system of claim 1, wherein the cybersecurity score is adjusted to reflect a use to which the computer system will be put. ### Claim 6 (depends on 1) The system of claim 1, wherein the cybersecurity score is adjusted to reflect a criticality of the computer system to overall operations of a business or larger network of computers. ### Claim 7 (depends on 1) The system of claim 1, wherein the cybersecurity score is adjusted to reflect a magnitude of losses that would occur if the system was compromised. ### Claim 8 A method for holistic computer system cybersecurity evaluation and rating, comprising the steps of: receiving a system definition comprising a software definition, a hardware definition, and an operating system definition for a second computing device; identifying a software function defined by the software definition and compare the function to a database of software functions to establish a software cybersecurity score; identifying a hardware component defined by the hardware definition and compare the component to a database of components to establish a hardware cybersecurity score; identifying an operating system function defined by the operating system definition and compare the function to a database of operating system functions to establish an operating system cybersecurity score; and generating a cybersecurity score for the second computing device based on a combination of the software cybersecurity score, hardware cybersecurity score, and operating system cybersecurity score. ### Claim 9 (depends on 9) The method of claim 9, wherein the software definition comprises source code for an application and further comprising the step of analyzing the coding complexity of the source code to update the software cybersecurity score. ### Claim 10 (depends on 9) The method of claim 9, wherein: the software definition comprises executable binary code for an application; the hardware definition comprises a specification for a processor of the second computing device; the operating system definition comprises executable binary code for an operating system; and further comprising the steps of: emulating the operation of the second computing device on the first computing device; receiving and installing the operating system on the emulated second computing device; receiving and installing the application on the emulated second computing device; operating the application on the emulated second computing device using the operating system; extracting a function of the application to use as the software function by analyzing the operation of the application on the emulated second computing device; extracting a function of the operating system to use as the operating system function by analyzing the operation of the operating system on the emulated second computing device; analyzing an operation of the second computing device by executing an operation on the emulated second computing device associated with a known hardware exploit to: determine whether the emulated second computing device is susceptible to the exploit; and update the hardware cybersecurity score using the determination. ### Claim 11 (depends on 9) The method of claim 9, further comprising the step of adjusting the cybersecurity score to reflect a domain in which the computer system will be used. ### Claim 12 (depends on 9) The method of claim 9, further comprising the step of adjusting the cybersecurity score to reflect a use to which the computer system will be put. ### Claim 13 (depends on 9) The method of claim 9, further comprising the step of adjusting the cybersecurity score to reflect a criticality of the computer system to overall operations of a business or larger network of computers. ### Claim 14 (depends on 9) The method of claim 9, further comprising the step of adjusting the cybersecurity to reflect a magnitude of losses that would occur if the system was compromised. ### Claim 15 A method for holistic computer system cybersecurity rating, comprising the steps of: generating a base cybersecurity score for a computing device by combining separate analyses of a software component, a hardware component, and an operating system component of a computer system; adjusting the cybersecurity score to reflect a domain in which the computer system will be used; adjusting the cybersecurity score to reflect a use to which the computer system will be put; adjusting the cybersecurity score to reflect a criticality of the computer system to overall operations of a business or larger network of computers; and adjusting the cybersecurity to reflect a magnitude of losses that would occur if the system was compromised.