Abstract: Providing a risk analysis report for an undesired event includes receiving a request comprising undesired event data defining an undesired event, wherein the undesired event data corresponds to an asset, identifying, from an attack database, one or more sets of attack attributes related to the undesired event data, and identifying one or more protection measures relevant to the asset and the attack attributes. The technique also includes performing a first set of Monte Carlo simulations for the undesired event based on combinations of the attack attributes, the protection measures, and the asset, and performing a second set of Monte Carlo simulations for the undesired event based on a subset of the combinations of the attack attribute. One or more combinations of the attack attributes, the protection measures, and the asset which result in the undesired event are provided in accordance with outcomes.

Abstract: Providing a risk analysis report for an undesired event may include identifying an attack type resulting in the undesired event and at least one requirement for a successful attack. Providing the report may further include obtaining protection data associated with protection measures that affect the requirements for a successful attack, performing each simulation in a plurality of Monte Carlo simulations for the attack type a number N of times based on the undesired event, the attack type, and the protection data, and in response to determining that the N performances of a simulation indicate at least one wildcard, performing it an additional N times. Providing the report may also include identifying a vulnerability of the protection measures to the attack type based on the performances of the plurality of Monte Carlo simulations and generating the risk analysis report for the undesired event based on the attack type and the vulnerability.

Abstract: Providing a risk analysis report for an undesired event may include identifying an attack type resulting in the undesired event and at least one requirement for a successful attack. Providing the report may further include obtaining protection data associated with protection measures that affect the requirements for a successful attack, performing each simulation in a plurality of Monte Carlo simulations for the attack type a number N of times based on the undesired event, the attack type, and the protection data, and in response to determining that the N performances of a simulation indicate at least one wildcard, performing it an additional N times. Providing the report may also include identifying a vulnerability of the protection measures to the attack type based on the performances of the plurality of Monte Carlo simulations and generating the risk analysis report for the undesired event based on the attack type and the vulnerability.