Modeling Local Exploit Hazard - A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency
2026-07-27 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors present a new model that helps organizations figure out the daily risk of cyberattacks on their own computer systems, based on global data about how likely different software weaknesses are to be exploited. They use expert opinions combined with real-world testing data to adjust these risks for specific attack methods, then turn these into daily risk rates using statistical methods that consider how risk changes over time. These rates can be added up to show risk levels across parts or all of an organization. The model also helps decide which security fixes will best reduce risk, providing a clear way for defenders to prioritize their actions.
Bayesian frameworkExploit Likelihood Model (ELM)Exploit Prediction Scoring System (EPSS)Beta-Binomial inferenceSurvival analysisWeibull hazardVulnerability exploitationAttack-vector alignmentCybersecurity riskRemediation prioritization
Authors
Stephen Shaffer, Laura Voicu
Abstract
This paper presents a local exploit hazard model : a Bayesian framework that converts the global probabilities produced by an exploit likelihood model (ELM), such as the Exploit Prediction Scoring System (EPSS), into a daily exploit hazard rate for an organization's own assets. The model measures the exploit-prevention effectiveness of deployed controls as a probability distribution. That distribution is seeded from a subject-matter-expert opinion pool and updated through Beta-Binomial inference from telemetry, breach-and-attack simulation, or penetration testing, then applied to ELM scores by attack-vector alignment. The resulting per-vulnerability exploitation likelihoods are converted into hazard rates using standard survival-analysis techniques, supporting both a constant exponential hazard and a Weibull hazard whose shape parameter, calibrated from Known Exploited Vulnerabilities catalog timing, captures the empirical decay of exploitation risk as a vulnerability ages. Because hazards are additive under independence, per-vulnerability rates aggregate by summation up to host, network, business unit, and organization. Candidate remediation actions are simulated and ranked by projected hazard reduction, giving defenders a defensible, quantitative basis for prioritization under fixed capacity. Future work includes extensions for incident likelihood and financial loss modeling.