An organizational cyber security system and method

An organizational cyber security method, comprising, as part of performing a process:

• obtaining, by a processing circuitry:
• (a) organization characterization information characterizing an organization, the organization characterization information including at least one of:
• (i) organizational assets information of organizational assets of the organization, (ii) configurations information of configurations of the organizational assets, and (iii) relationships information of relationships between the organizational assets;
• and
• (b) known threats information of known cyber security threats, wherein each of the cyber security threats poses a threat on respective target organizations associated with target characterization information including at least one of:
• (i) target organizational assets information of target organizational assets of the respective target organization, (ii) target configurations information of target configurations of the target organizational assets, and (iii) target relationships information of target relationships between the target organizational assets;
• identifying, by the processing circuitry, one or more potential threats of the known cyber security threats that pose the respective threats to the organization, being the known cyber security threats that are executable on the organizational assets according to the organization characterization information;
• and
• generating, by the processing circuitry, one or more attack scenarios simulating execution of one or more of the potential threats on one or more of the organizational assets, being target organizational assets.

A non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code, executable by at least one processor of a computer to perform a method comprising, as part of performing a process:

• obtaining, by a processing circuitry:
• (a) organization characterization information characterizing an organization, the organization characterization information including at least one of:
• (i) organizational assets information of organizational assets of the organization, (ii) configurations information of configurations of the organizational assets, and (iii) relationships information of relationships between the organizational assets;
• and
• (b) known threats information of known cyber security threats, wherein each of the cyber security threats poses a threat on respective target organizations associated with target characterization information including at least one of:
• (i) target organizational assets information of target organizational assets of the respective target organization, (ii) target configurations information of target configurations of the target organizational assets, and (iii) target relationships information of target relationships between the target organizational assets;
• identifying, by the processing circuitry, one or more potential threats of the known cyber security threats that pose the respective threats to the organization, being the known cyber security threats that are executable on the organizational assets according to the organization characterization information;
• and
• generating, by the processing circuitry, one or more attack scenarios simulating execution of one or more of the potential threats on one or more of the organizational assets, being target organizational assets.