Abstract: An apparatus and a method for cybersecurity, the apparatus comprising a processor being configured to execute instructions in a memory to control the apparatus to receive an input for a subject address in a target blockchain system and to obtain a list of addresses involved in a predefined number of hops of transactions upstream and/or downstream of the subject address in the target blockchain system. Suspicious transaction behaviour of addresses in the obtained list of addresses upstream and/or downstream of the subject address are identified by the apparatus. A risk score indicative of degree of cybersecurity threat for the subject address taking into consideration the suspicious transaction behaviour is then calculated.