A Bayesian Network-Based Framework for Cyber Risk Assessment and Asset Prioritization

Abstract

Modern organizations face continuously evolving cyber threats, while traditional risk assessment approaches rely on static vulnerability scoring and fail to capture uncertainty and attacker behavior. This work proposes a Bayesian Network-based cyber risk assessment framework that dynamically evaluates and prioritizes enterprise assets based on compromise likelihood. The system models dependency relationships between threat likelihood, vulnerability severity, and exploit success probability using conditional probability inference. Security data is processed into probabilistic variables and posterior risk values are computed to rank assets into high, medium, and low risk categories. Unlike conventional scoring models, the proposed framework continuously updates risk when new evidence appears, enabling predictive defense prioritization. Experimental evaluation demonstrates improved contextual risk identification and effective prioritization of critical assets. The proposed approach provides a scalable and interpretable decision-support mechanism suitable for enterprise cybersecurity operations.