Inferential analysis using feedback for extracting and combining cyber risk information
Inferential analysis includes: assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least one accessible Internet elements, automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy; and automatically recommending, based on the assessed risk, a computer network change to reduce the assessed risk.
1. A method, comprising:
assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least one accessible Internet elements, wherein the assessing of the risk comprises:
determining circumstantial or indirect information that is indicative of the entity based on the collected information; and
determining a relative strength of the circumstantial or indirect information;
automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy;
automatically recommending, based on the assessed risk, a computer network change to reduce the assessed risk;
reassessing the risk of the cyber security failure in the computer network of the entity; and
based on the reassessed risk of the cyber security failure in the computer network of the entity, predicting, at least in part by utilizing machine learning, an action of the entity.
2. The method of claim 1 , wherein the cyber security failure comprises a privacy incident involving sensitive information.
3. The method of claim 1 , wherein the computer agent is further configured to perform: collecting information from the computer network of the entity, analyzing information from the computer network of the entity, or both.
4. The method of claim 1 , further comprising:
determining that the entity has enacted at least a portion of the recommended computer network change; and
initiating a change or a setting to the at least one element of policy criteria of the cyber security policy.
5. The method of claim 4 , further comprising estimating at least one impact to the entity for the cyber security failure, the estimating being dynamically calculated based at least in part on the determination that the entity has enacted at least a portion of the recommended computer network change.
6. The method of claim 1 , wherein the recommended computer network change is implemented automatically without intervention of the entity.
7. The method of claim 1 , wherein the cyber security policy includes:
a cyber security policy from another entity;
a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider; or
both.
8. A system, comprising:
a memory; and
one or more hardware processors coupled to the memory and configured to:
assess risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least one accessible Internet elements, wherein the assessing of the risk comprises:
determine circumstantial or indirect information that is indicative of the entity based on the collected information; and
determine a relative strength of the circumstantial or indirect information;
automatically determine, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy;
automatically recommend, based on the assessed risk, a computer network change to reduce the assessed risk;
reassess the risk of the cyber security failure in the computer network of the entity; and
based on the reassessed risk of the cyber security failure in the computer network of the entity, predict, at least in part by utilizing machine learning, an action of the entity.
9. The system of claim 8 , wherein the cyber security failure comprises a privacy incident involving sensitive information.
10. The system of claim 8 , wherein the computer agent is further configured to: collect information from the computer network of the entity, analyze information from the computer network of the entity, or both.
11. The system of claim 8 , wherein the one or more hardware processors are further configured to:
determine that the entity has enacted at least a portion of the recommended computer network change; and
initiate a change or a setting to the at least one element of policy criteria of the cyber security policy.
12. The system of claim 11 , wherein the one or more hardware processors are further configured to:
estimate at least one impact to the entity for the cyber security failure, the estimation being dynamically made based at least in part on the determination that the entity has enacted at least a portion of the recommended computer network change.
13. The system of claim 8 , wherein the recommended computer network change is implemented automatically without intervention of the entity.
14. The system of claim 8 , wherein the cyber security policy includes:
a cyber security policy from another entity;
a product warranty for first and/or third party costs that the entity purchases from at least one of a networking, security product, and services provider; or
both.
15. A computer program product embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:
assessing risk of a cyber security failure in a computer network of an entity, using a computer agent configured to collect information from at least one accessible Internet elements, wherein the assessing of the risk comprises:
determining circumstantial or indirect information that is indicative of the entity based on the collected information; and
determining a relative strength of the circumstantial or indirect information;
automatically determining, based on the assessed risk, a change or a setting to at least one element of policy criteria of a cyber security policy;
automatically recommending, based on the assessed risk, a computer network change to reduce the assessed risk;
reassessing the risk of the cyber security failure in the computer network of the entity; and
based on the reassessed risk of the cyber security failure in the computer network of the entity, predicting, at least in part by utilizing machine learning, an action of the entity.