Mitigation Control Detection and Risk Reduction

A system comprising:

• data processing hardware;
• and
• memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
• obtaining a plurality of security vulnerabilities for a networked device, each security vulnerability of the plurality of security vulnerabilities representing an exploitable weakness of the networked device;
• for a first security vulnerability of the plurality of security vulnerabilities:
• deterministically identifying a first mitigation for the first security vulnerability;
• based on identifying the first mitigation, determining that the first mitigation is applied to the networked device;
• and
• based on determining that the first mitigation is applied to the networked device, lowering a risk associated with the first security vulnerability;
• and
• for a second security vulnerability of the plurality of security vulnerabilities:
• determining that a second mitigation for the second security vulnerability cannot be identified deterministically;
• based on determining that the second mitigation cannot be identified deterministically, identifying, using a non-deterministic model, the second mitigation;
• based on identifying the second mitigation, determining that the second mitigation is applied to the networked device;
• and
• based on determining that the second mitigation is applied to the networked device, lowering a risk associated with the second security vulnerability.

A computer-readable medium having instructions that, when executed by data processing hardware, causes the data processing hardware to perform operations comprising:

• obtaining a plurality of security vulnerabilities for a networked device, each security vulnerability of the plurality of security vulnerabilities representing an exploitable weakness of the networked device;
• for a first security vulnerability of the plurality of security vulnerabilities:
• deterministically identifying a first mitigation for the first security vulnerability;
• based on identifying the first mitigation, determining that the first mitigation is applied to the networked device;
• and
• based on determining that the first mitigation is applied to the networked device, lowering a risk associated with the first security vulnerability;
• and
• for a second security vulnerability of the plurality of security vulnerabilities:
• determining that a second mitigation for the second security vulnerability cannot be identified deterministically;
• based on determining that the second mitigation cannot be identified deterministically, identifying, using a non-deterministic model, the second mitigation;
• based on identifying the second mitigation, determining that the second mitigation is applied to the networked device;
• and
• based on determining that the second mitigation is applied to the networked device, lowering a risk associated with the second security vulnerability.