Abstract: A method includes evaluating topologies of controls against hypothetical threat events to produce an effectiveness score for each topology versus threat events by aggregating the controls that make up each of the topologies. The topologies and the effectiveness scores are stored in a database of topologies. A threat event is identified, and based on the threat event and the effectiveness scores, topologies are identified from the database of topologies configured to provide protection against the threat event. An updated effectiveness score is derived for each of the identified topologies, which is used to determine a vulnerability score associated with the topologies. One of the topologies is selected to protect against the threat event based on the updated effectiveness score. The selected topology is validated to ensure that the computer system control environment has not changed since the selected topology was evaluated. After validating, the selected topology is activated.

Abstract: A method of deriving an aggregate vulnerability of a computer system, the method including identifying a threat event associated with a possible loss and based on the threat event, identifying a plurality of relevant controls configured to provide protection against the threat event. The method further including assigning an effectiveness score to each of the plurality of relevant controls, aggregating each effectiveness score assigned to each of the plurality of relevant controls to generate an aggregated effectiveness score and determining, based on the aggregated effectiveness score, a vulnerability score associated with the plurality of relevant controls.