Detecting and Quantifying Vulnerabilities in a Network System

A method comprising:

• receiving, via a communication interface and from a computing device, indications of usage of a plurality of controls associated with an enterprise computing system;
• identify, based on a mapping between the plurality of controls and a plurality of attack vectors, one or more controls of the plurality of controls that are mapped to an attack vector;
• determining, based on indications of usage of the one or more controls, respective compliance scores of the one or more controls;
• determining, based on the respective compliance scores, a vulnerability score associated with the attack vector;
• and
• sending, via the communication interface to the computing device, an indication of the determined vulnerability score associated with the attack vector.

A non-transitory computer readable medium storing computer executable instructions that, when executed by a processor, cause:

• receiving, via a communication interface and from a computing device, indications of usage of a plurality of controls associated with an enterprise computing system;
• identify, based on a mapping between the plurality of controls and a plurality of attack vectors, one or more controls of the plurality of controls that are mapped to an attack vector;
• determining, based on indications of usage of the one or more controls, respective compliance scores of the one or more controls;
• determining, based on the respective compliance scores, a vulnerability score associated with the attack vector;
• transmitting, via the communication interface to the computing device, an indication of the determined vulnerability score associated with the attack vector.