System and method for assessing cybersecurity risk of computer network

An article of manufacture including a non-transitory, tangible computer readable storage medium having instructions stored thereon that, in response to execution by a processor, cause the processor to perform operations comprising:

• analyzing, by the processor, operational characteristics of a computer network using a risk model to determine a threat likelihood value, a business impact value and a control effectiveness value,
• wherein the business impact value is based on asset data associated with an operational configuration of the computer network, and
• wherein the control effectiveness value is based on how security controls reduce an implicit risk score;
• determining, by the processor, a product of the threat likelihood value and the business impact value;
• deducting, by the processor, the control effectiveness value from the product to create a residual risk score;
• and
• determining, by the processor, a forecast of cybersecurity risk parameters based on the residual risk score and the implicit risk score.

A system comprising:

• a processor;
• and
• a tangible, non-transitory memory configured to communicate with the processor,
• the tangible, non-transitory memory having instructions stored thereon that, in response to execution by the processor, cause the processor to perform operations comprising:
• analyzing, by the processor, operational characteristics of a computer network using a risk model to determine a threat likelihood value, a business impact value and a control effectiveness value,
• wherein the business impact value is based on asset data associated with an operational configuration of the computer network, and
• wherein the control effectiveness value is based on how security controls reduce an implicit risk score;
• determining, by the processor, a product of the threat likelihood value and the business impact value;
• deducting, by the processor, the control effectiveness value from the product to create a residual risk score;
• and
• determining, by the processor, a forecast of cybersecurity risk parameters based on the residual risk score and the implicit risk score.