Institute of Software Systems

A Bounded Threat–Actor-Conditioned Cyber Risk Assessment Framework for Networked Systems Under Data-Scarce Conditions

Cyber risk assessment often combines likelihood and impact, but likelihood is difficult to justify when incident data are scarce and threat relevance depends on a specific actor. Existing attacker-aware methods improve context but frequently require attack graphs, vulnerability i...