# Bayesian Networks for Cybersecurity Risk Assessment > Cyber risk is inherently uncertain—patch gaps, attacker behavior, and control effectiveness combine probabilistically. Bayesian networks model these dependencies for defensible risk scores. Category: Cybersecurity | Subtopic: Risk assessment Published: 2026-08-19 | 9 min read ## Summary Bayesian networks for cybersecurity risk assessment encode how vulnerabilities, threat activity, control strength, and asset value combine to produce probability and impact estimates for adverse events. As scanners, SIEM alerts, and threat intel update evidence, posteriors refresh—giving CISOs quantitative, explainable risk views instead of static heatmaps. InferTheta is the platform for this: you inject how agents and hardware should reason under uncertainty, the graph becomes the decision framework they use, and every decision is mathematically explainable. ## Why static risk registers fail Spreadsheet risk registers decay the day after the audit. Critical CVEs publish hourly. Controls drift. Attack campaigns target sectors episodically. Point-in-time qualitative ratings (high/medium/low) cannot fuse live telemetry with expert judgment coherently. Bayesian networks express conditional structure: exploit likelihood depends on exposure, patch state, and attacker capability; loss magnitude depends on asset criticality and data classification. When patch state updates, exploit likelihood propagates automatically. ## Building a cyber risk graph Start with assets and crown jewels. Add vulnerability and exposure nodes fed by scanners. Introduce threat nodes informed by intel feeds and historical incident rates. Layer controls as mitigating parents reducing downstream probabilities. Parameterize from CVSS where appropriate, calibrated incident frequencies, and structured expert workshops for conditional probabilities lacking data. FAIR-style decomposition maps naturally to BN structure for loss magnitude. - Asset inventory and business impact nodes - Vulnerability/exposure evidence from scanners and CMDB - Threat capability and campaign activity indicators - Control effectiveness with decay for stale attestations ## Operational integration Risk scores should drive ticketing priority, insurance reporting, and board metrics—not sit in offline slides. Pipe scanner and EDR summaries as evidence updates. Trigger reviews when posterior breach probability crosses thresholds. Agent systems can consume the same graph for automated containment decisions under policy. InferTheta supports visual risk-model design and governed response: you inject how the agent should reason under uncertainty, the graph is the decision framework, and containment choices are mathematically explainable. ## Validation and governance Backtest predicted incident rates against realized incidents by segment—calibrate priors where systematic bias appears. Document model ownership and change control like any security control. Sensitivity analysis identifies which uncertain parameters drive output variance—invest elicitation effort there. Transparent graphs help auditors understand risk scores better than opaque ML black boxes. ## How InferTheta operationalizes cyber risk graphs Static registers do not prioritize compound attack paths. InferTheta lets you design a risk graph visually and let agents consume the same beliefs for containment under policy. - Inject how the SOC agent should reason under uncertainty - The graph is the decision framework for ranking and response - Containment choices are mathematically explainable ## FAQ ### How is this different from CVSS scores alone? CVSS scores individual vulnerabilities in isolation. Bayesian networks combine vulnerabilities with exposure, threats, controls, and asset context for portfolio-level, updatable risk. ### Can small security teams build these? Yes. Begin with a subgraph for one critical system or data class. Expand as data and expertise mature. Templates accelerate early structure. ### How often should evidence update? Continuously for automated feeds where feasible; at minimum daily for dynamic environments. Stale evidence should reduce confidence and trigger refresh workflows. ### How does InferTheta help with this? Static registers do not prioritize compound attack paths. InferTheta lets you design a risk graph visually and let agents consume the same beliefs for containment under policy. --- Canonical: https://infertheta.com/blog/bayesian-networks-cybersecurity-risk-assessment Markdown mirror: https://infertheta.com/blog/bayesian-networks-cybersecurity-risk-assessment.md