Systems and methods for performing cybersecurity risk assessments

1. A cybersecurity analyzing system for assessing potential cybersecurity threats to a subject system, the system comprising:

a computing device comprising at least one processor in communication with at least one memory device, wherein the at least one processor is programmed to:

receive a subject system to analyze;

determine a potential hazard event associated with the subject system;

generate an attack graph associated with the potential hazard event, wherein the attack graph includes a plurality of actions, and wherein the plurality of actions includes at least one action that is a physical action outside of the subject system to analyze;

determine an exploitability score for each of the plurality of actions;

determine an uncertainty level for each of the plurality of actions based on the corresponding exploitability score;

aggregate the plurality of actions including the corresponding exploitability scores and the corresponding uncertainty levels to determine one or more vulnerabilities of the subject system; and

generate a response to the one or more vulnerabilities of the subject system.

2. The system of claim 1 , wherein the subject system to analyze is at least one of a computer or a computer network.

3. The system of claim 1 , wherein the exploitability score represents an adversary ability level to perform the corresponding action.

4. The system of claim 1 , wherein the uncertainty level represents a confidence level associated with the determination of the exploitability score.

5. The system of claim 1 , wherein the at least one processor is further programmed to:

determine one or more countermeasures based on the one or more vulnerabilities;

apply the one or more countermeasures to the attack graph; and

aggregate the plurality of actions based on the one or more countermeasures.

6. The system of claim 1 , wherein the at least one processor is further programmed to:

determine a plurality of potential hazard events for the subject system;

generate a plurality of attack graphs based on each of the plurality of potential hazard events; and

aggregate the plurality of actions for each of the plurality of attack graphs based on the corresponding plurality of exploitability scores and the corresponding plurality of uncertainty levels to determine one or more vulnerabilities of the subject system.

7. The system of claim 1 , wherein the attack graph includes a plurality of attack paths, and wherein each attack path includes one or more actions from the plurality of actions.

8. The system of claim 7 , wherein the at least one processor is further programmed to aggregate each of the plurality of attack paths based on the one or more actions associated with the corresponding attack path.

9. The system of claim 7 , wherein the one or more vulnerabilities are based on at least one of the plurality of attack paths.

10. The system of claim 1 , wherein each of the plurality of actions are adversarial actions.

11. A method for assessing potential cybersecurity threats to a subject system, the method implemented on a computing device including at least one processor in communication with at least one memory device, the method comprising:

receiving a subject system to analyze;

determining a potential hazard event associated with the subject system;

generating an attack graph associated with the potential hazard event, wherein the attack graph includes a plurality of actions, and wherein the plurality of actions includes at least one action that is a physical action outside of the subject system to analyze;

determining an exploitability score for each of the plurality of actions;

determining an uncertainty level for each of the plurality of actions based on the corresponding exploitability score;

aggregating the plurality of actions including the corresponding exploitability scores and the corresponding uncertainty levels to determine one or more vulnerabilities of the subject system; and

generating a response to the one or more vulnerabilities of the subject system.

12. The method of claim 11 , wherein the subject system to analyze is at least one of a computer or a computer network.

13. The method of claim 11 , wherein the exploitability score represents an adversary ability level to perform the corresponding action.

14. The method of claim 11 , wherein the uncertainty level represents a confidence level associated with the determination of the exploitability score.

15. The method of claim 11 further comprising:

determining one or more countermeasures based on the one or more vulnerabilities;

applying the one or more countermeasures to the attack graph; and

aggregating the plurality of actions based on the one or more countermeasures.

16. The method of claim 11 further comprising:

determining a plurality of potential hazard events for the subject system;

generating a plurality of attack graphs based on each of the plurality of potential hazard events; and

aggregating the plurality of actions for each of the plurality of attack graphs based on the corresponding plurality of exploitability scores and the corresponding plurality of uncertainty levels to determine one or more vulnerabilities of the subject system.

17. The method of claim 11 , wherein each attack graph of the plurality of attack graphs includes a plurality of attack paths, wherein each attack path includes one or more actions of the plurality of actions, and wherein the method further comprises aggregating each of the plurality of attack paths based on the one or more actions associated with the corresponding attack path.

18. The method of claim 17 , wherein the one or more vulnerabilities are based on at least one of the plurality of attack paths.

19. The method of claim 11 , wherein each of the plurality of actions are adversarial actions.

20. A non-transitory computer-readable media having computer-executable instructions embodied thereon, wherein, when executed by at least one processor coupled to a memory device, the computer-executable instructions cause the processor to:

receive a subject system to analyze, wherein the subject system to analyze is at least one of a computer or a computer network;

determine a potential hazard event associated with the subject system;

generate an attack graph associated with the potential hazard event, wherein the attack graph includes a plurality of actions, and wherein the plurality of actions includes at least one action that is a physical action outside of the subject system to analyze;

determine an exploitability score for each of the plurality of actions, wherein the exploitability score represents an adversary ability level to perform the corresponding actions;

determine an uncertainty level for each of the plurality of actions based on the corresponding exploitability score, wherein the uncertainty level represents a confidence level associated with the determination of the exploitability score;

aggregate the plurality of actions including the corresponding exploitability scores and the corresponding uncertainty levels to determine one or more vulnerabilities of the subject system;

determine one or more countermeasures based on the one or more vulnerabilities;

apply the one or more countermeasures to the attack graph;

aggregate the plurality of actions based on the one or more countermeasures; and

generate a response to the one or more vulnerabilities of the subject system.