Risk assessment and remediation

1. A computer-implemented method of assessing and addressing computer security risk, comprising:

receiving, by a processor, a request from a client device for an engagement to identify vulnerabilities of a networked computer system;

computing, by the processor, a pre-engagement risk score for the networked computer system corresponding to a plurality of vulnerability areas;

causing, by the processor, performance of a penetration test as part of the engagement by a plurality of researcher computers to identify vulnerabilities of the networked computer system in at least one of the plurality of vulnerability areas;

determining a researcher computer cost describing a cost incurred by the plurality of researcher computers during the engagement;

determining a vulnerability factor associated with a group of vulnerabilities identified by the plurality of researcher computers during the engagement;

calculating a post-engagement risk score for the networked computer system based on the researcher computer cost and the vulnerability factor;

transmitting the post-engagement risk score to the client device to improve security of networked computer system.

2. The computer-implemented method of claim 1 , computing the pre-engagement risk score being based on a transfer susceptibility flag for the networked computer system, a number of undesirable services found in the networked computer system, a number and severity of vulnerability found in the networked computer system, a size of the networked computer system, and an SSL strength score of the networked computer system.

3. The computer-implemented method of claim 1 , determining the researcher computer cost further comprising calculating a researcher computer efficiency based on a severity level of the group of vulnerabilities and a researcher computer power, the researcher computer power further based on a number of computer attacks made to the networked computer system by the plurality of researcher computers during a given period of time within the engagement.

4. The computer-implemented method of claim 3 , determining the researcher computer cost further comprising taking an inverse of the researcher computer efficiency.

5. The computer-implemented method of claim 3 , determining the researcher computer cost further comprising standardizing, shifting or scaling the researcher computer efficiency into a specific domain.

6. The computer-implemented method of claim 3 , the severity level of the group of vulnerabilities being a weighted sum of raw vulnerability scores of the group of vulnerabilities, with larger weights given to larger raw vulnerability scores of the group of vulnerabilities.

7. The computer-implemented method of claim 1 , determining the vulnerability factor further comprising:

assigning each of the group of vulnerabilities to one of a plurality of classes of severity levels;

computing the vulnerability factor based on a size of each of the plurality of classes.

8. The computer-implemented method of claim 1 , further comprising:

computing a scaled value for a raw vulnerability score of each of the group of vulnerabilities based on linear models,

the linear models producing larger scales for intervals of larger raw vulnerability scores,

updating the calculating a post-engagement risk score with the group of scaled values.

9. The computer-implemented method of claim 1 , further comprising

computing a resilience score reflecting a strength of the networked computer system against computer attacks hitting the networked computer system during the engagement,

calculating the post-engagement risk score for the networked computer system being further based on the resilience score.

10. The computer-implemented method of claim 9 , computing the resilience score further comprising:

causing application of one or more software patches to remediate the group of vulnerabilities;

determining a patch remediation time associated with the application;

calculating a patch efficacy associated with the application;

computing the resilience score based on the patch remediation time and the patch efficacy.

11. The computer-implemented method of claim 10 , determining the patch remediation time further comprising:

assigning each of the one or more software patches into a plurality of classes corresponding to different amounts of time taken for patch application;

computing the patch remediation time based on a size of each of the plurality of classes.

12. The computer-implemented method of claim 10 , the patch efficacy being calculated as an aggregate of patch efficacy over the one or more software patches.

13. The computer-implemented method of claim 1 , further comprising:

calculating a post-engagement risk score upon identification of each of a subset of the group of vulnerabilities during the engagement;

determining a slope from the subset of post-engagement risk scores obtained over a time interval during the engagement;

computing a final post-engagement risk score based on the last-calculated post-engagement score and the slope.

14. The computer-implemented method of claim 13 , determining the slope comprising performing a linear regression over the time interval at once.

15. The computer-implemented method of claim 13 , determining the slope comprising:

performing a linear regression over each of a plurality of sub-intervals of the time interval each time;

aggregating a plurality of results of the plurality of linear regressions.

16. The computer-implemented method of claim 13 , computing the post-engagement risk score further comprising:

computing a multiplier that has a smaller value when the slope has a larger value;

computing the post-engagement risk score based on the multiplier.

17. The computer-implemented method of claim 1 , the networked computer system comprising one or more of a host computer platform, a mobile platform, and a web platform.

18. The computer-implemented method of claim 1 , further comprising determining a relative measure of the post-engagement risk score to a group of post-engagement risk scores for other networked computer systems.

19. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause performance of a method, the method comprising:

receiving a request for an engagement to identify vulnerabilities of a networked computer system;

computing a pre-engagement risk score for the networked computer system corresponding to a plurality of vulnerability areas;

causing performance of a penetration test as part of the engagement by a plurality of researcher computers to identify vulnerabilities of the networked computer system in at least one of the plurality of vulnerability areas;

determining a researcher computer cost describing a cost incurred by the plurality of researcher computers during the engagement;

determining a vulnerability factor associated with a group of vulnerabilities identified by the plurality of researcher computers during the engagement;

calculating a post-engagement risk score for the networked computer system based on the researcher computer cost and the vulnerability factor;

transmitting the post-engagement risk score to a client device to improve security of networked computer system.

20. A computer system, comprising:

one or more processors;

a memory comprising a set of instructions which when executed causes the one or more processors to execute a method, the method comprising:

receiving a request for an engagement to identify vulnerabilities of a networked computer system;

computing a pre-engagement risk score for the networked computer system corresponding to a plurality of vulnerability areas;

causing, by the processor, performance of a penetration test as part of the engagement by a plurality of researcher computers to identify vulnerabilities of the networked computer system in at least one of the plurality of vulnerability areas;

determining a researcher computer cost describing a cost incurred by the plurality of researcher computers during the engagement;

determining a vulnerability factor associated with a group of vulnerabilities identified by the plurality of researcher computers during the engagement;

calculating a post-engagement risk score for the networked computer system based on the researcher computer cost and the vulnerability factor;

transmitting the post-engagement risk score to a client device to improve security of networked computer system.