System and method for empirical organizational cybersecurity risk assessment using externally-visible data

A system comprising:

• at least one programmable processor;
• and
• a machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
• generating a set of features based on a plurality of datasets, the set of features indicative of cybersecurity data breach risks of a computer network associated with an organization, the plurality of datasets corresponding to a plurality of network prefixes of the computer network associated with the organization, the plurality of datasets comprising an IP address mapped to the network prefixes and comprising data representative of responses by the network prefixes to various requests at the IP address;
• calibrating, in response to generating the set of features, the set of features with a quantile estimate from a database, the quantile estimate being calibrated by comparing cybersecurity breach risks across various organizations;
• and
• scoring, based on the calibrated set of features, the plurality of datasets as an overall score, the scoring processed according to a cybersecurity breach risk scoring model executed by the at least one programmable processor on the plurality of datasets.

A computer-implemented method comprising:

• generating, by at least one data processor, a set of features based on a plurality of datasets, the set of features indicative of cybersecurity data breach risks of a computer network associated with an organization, the plurality of datasets corresponding to a plurality of network prefixes of the computer network associated with the organization, the plurality of datasets comprising an IP address mapped to the network prefixes and comprising data representative of responses by the network prefixes to various requests at the IP address;
• calibrating, by the at least one data processor and in response to generating the set of features, the set of features with a quantile estimate from a database, the quantile estimate being calibrated by comparing cybersecurity breach risks across various organizations;
• and
• scoring, by the at least one data processor and based on the calibrated set of features, the plurality of datasets as an overall score, the scoring processed according to a cybersecurity breach risk scoring model executed by the at least one data processor on the plurality of datasets.

A computer program product comprising a non-transitory machine-readable medium storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:

• generating a set of features based on a plurality of datasets, the set of features indicative of cybersecurity data breach risks of a computer network associated with an organization, the plurality of datasets corresponding to a plurality of network prefixes of the computer network associated with the organization, the plurality of datasets comprising an IP address mapped to the network prefixes and comprising data representative of responses by the network prefixes to various requests at the IP address;
• calibrating, in response to generating the set of features, the set of features with a quantile estimate from a database, the quantile estimate being calibrated by comparing cybersecurity breach risks across various organizations;
• and
• scoring, based on the calibrated set of features, the plurality of datasets as an overall score, the scoring processed according to a cybersecurity breach risk scoring model executed by the at least one programmable processor on the plurality of datasets.