Quantifying Swiss Cheese, the Bayesian Way
summary
Builds a living Bayesian model that combines EPSS scores, asset inventories, control-effectiveness beta priors and breach‑and‑attack simulation telemetry to produce control‑adjusted, per‑asset exploitation likelihoods and an aggregated organizational hazard rate. It converts 30‑day exploit probabilities to hazard rates, generates a loss exceedance curve and simulates remediation to show dollar reduction per action, finding broad patch cadence beats many point fixes. Notes heavy independence assumptions and uncertainty and uses beta Bayesian updating to continuously refine estimates.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:06Why risk quantification matters
- 3:39Limitations of current methods
- 8:20Building risk model
- 13:34Measuring control effectiveness
- 21:38Asset exploit likelihood
- 27:18Modeling incident risk
- 35:00Operationalizing risk reduction
- 42:10Model validation
- 45:19Q&A
related talks
27mModeling Asset Risk Using Grouped EPSS
51mFAIR STRIDE - Building Business Relevant Threat Models
44mOpening Keynote: Prove It! Confronting Security With Data.
43mChanging from Probability to Prioritization Method in Risk Measurement
45mThe Business Value of Security
28mUsing Changepoint and Bayesian Analysis to Drive Safety Improvements in Mining
23mSecurity Outgunned: Measuring Software Defined Attack Surface
56mDecision Making in the Abscence of Ground Truth