How do you update and calibrate your cyber risk models based on new data and trends?

Strategic Adaptation to Technological Pace: As technology advances, so does the sophistication of cyber threats. A strategic insight for the constant update and calibration of cyber risk models is to embed adaptive mechanisms within the models themselves. These mechanisms would automatically adjust risk parameters in response to emerging threats detected through continuous threat intelligence feeds. This ensures that the models remain proactive rather than reactive, maintaining their relevance between formal review periods.

Cyber risk models rely on assumptions, parameters, and data reflecting the cyber environment, threats, and organizational exposure. Given rapid and unpredictable changes like technological advancements, vulnerabilities, regulations, and organizational shifts, these models require regular updates and calibration for validity and accuracy.

In cybersecurity, updating and calibrating risk models is non-negotiable. The cyber risk landscape changes quickly, so incorporating the latest information is crucial if you're using the data to make event forecasts and develop cybersecurity mitigation programs based on those results. Simply put, if CISOs and cyber risk managers aren't updating risk frequency assumptions, assessments will most likely produce skewed results that lead to action plans that potentially ignore some of the high-likelihood, high-impact events, leaving your organization vulnerable.

Dynamic Review Cycles Based on Risk Triggers: Instead of a static annual review, a more strategic approach would be to establish dynamic review cycles triggered by specific events or thresholds, such as the detection of new vulnerabilities, breaches within the industry, or changes in regulatory compliance requirements. This risk-based approach aligns the update frequency with the actual changes in the threat landscape and the organization's risk profile.

There are three more notable elements in understanding risk – threats exploiting vulnerabilities to destroy/damage assets. They are not static, with each evolving based changes in threat tactics, the technology environment, and organizational objectives. In this dynamic environment, cyber risk models require continuous analysis and evaluation.

It is important to monitor the risk and track how quickly different environment changes happen. In cyber, frequency of breaches can change quickly based on differences in targeting and defence strength, other parameters such as cost items may change more slowly over time. Having in place a robust calibration programme is key. It should be time based, but also a re-calibration can be triggered if the external or internal risk changes

At a minimum, cyber risk models need to be updated and calibrated at least once a quarter - especially considering how quickly the cyber risk landscape can evolve. Certain data sources are updated on a weekly basis, so it's best to ensure that information is embedded within your model. That being said, it's also important to keep in mind that updating the models too often would also be detrimental. Remember: you're using the model outputs to strategize and plan, and changing the model might lead to different priorities, potentially making your initial planning efforts obsolete.

Always consider the context of any data you collect. What is it telling you about your environment, and more importantly what is it not telling you. If you base your model only on SIEM/telemetry data you are only gathering data on what historically has been collected (and importantly adversaries are trying hard not to appear in these datasets). Understand what you might be missing with data!

Integrated Data Ecosystems: A critical insight for selecting data for model updates is the creation of an integrated data ecosystem that aggregates and correlates data from various internal and external sources. This ecosystem should utilize advanced analytics to filter out noise and identify relevant trends, enabling more accurate risk assessments. The integration of diverse data sources ensures a comprehensive view of the risk landscape and enhances the predictive capabilities of the cyber risk models.

Update and calibrate cyber risk models based on changing factors like technological advancements, vulnerabilities, regulations, and organizational shifts. Consider dynamic review cycles triggered by specific events, update at least annually, and use relevant internal and external data sources for calibration, including logs, alerts, incidents, threat intelligence, benchmarks, and best practices.

A robust framework for how your model is structured is a really important step to assess your scope and coverage against the risk register. Create an efficient process for collecting, processing and reviewing data, and the testing the impact on the model. Consider leveraging continuous integration/development processes to automate updates to the model.

Considering how quickly the cyber risk landscape evolves, it's best to harness a cyber risk model that automatically updates and calibrates. Doing this process manually not only is extremely resource-intensive, but it also leaves room open for human error. On-demand CRQ models do the necessary updates and calibrations for you and will alert you when the model has been fed with the latest, necessary data. When you get the notification, all you'll need to do is re-run the quantification by clicking a button. This time-to-value is essential in such a rapidly changing risk landscape.

Agile Model Development: The update and calibration process should be agile, incorporating iterative improvements and continuous feedback loops. By applying DevSecOps principles, you can ensure that the risk models evolve in tandem with the development of IT systems. This approach allows for incremental changes that can be rapidly deployed, reducing the time lag between the identification of a new risk and its reflection in the model.

Updating and calibrating cyber risk models involves reviewing existing models, collecting reliable data, analyzing with statistical methods, and reporting findings to stakeholders for informed decision-making in cyber risk management strategy.

Show your working, transparency is key. Get feedback regularly and share your results. It is likely a cyber model is there for a business purpose. Know this purpose and drive developments and model scope to achieving this. It is nice to have a model, it is great when the model is used to drive/inform decisions and impact business outcomes. Keep focused on this.

Stakeholder-Centric Model Enhancement: To improve cyber risk models, a strategic insight is to align model updates with stakeholder needs, including non-technical management. This means translating cyber risks into business impacts, which fosters broader engagement and support for cyber risk initiatives. By demonstrating how cyber risks can affect business objectives, you can ensure that model improvements are driven by both cyber intelligence and business strategy.

To improve cyber risk models, continuously update and calibrate them by incorporating new data sources, integrating with other risk models, aligning with organizational objectives, and engaging with stakeholders. This enhances insights into cyber risk exposure, captures interdependencies among risks, reflects risk appetite, and ensures model understanding.

Organizational Learning and Memory: An often-overlooked aspect is incorporating organizational learning into cyber risk models. After every significant cyber incident, whether internal or external, conducting a retrospective analysis to extract lessons learned and then applying these insights to update the risk models can be invaluable. This not only improves the models but also contributes to an organizational memory that enhances resilience against future threats.

The ultimate goal of cyber risk modeling is to deliver the most accurate and precise forecasts possible. When choosing a model, it's critical to assess the quality of the data as well as what you hope to achieve. For instance, if you want to establish credibility amongst other stakeholders, it's crucial to choose a model that harnesses objective, external global intelligence rather than relying on internally sourced information. It's also important to keep in mind that probabilistic models cannot predict the future. Instead, they offer data-driven outcomes that can help you plan for the future and keep your organization resilient in the wake of different cyber event magnitudes that might affect the organization.