Abstract: Simulated models for forecasting relative risk in a network system can be determined according to some examples. For example, a computing system can receive a set of risk data associated with a set of risk factors that are organized into a hierarchy of groupings. Each risk factor can be associated with one or more risk controls that each have a control strength value for reducing riskiness of the risk factor. The computing system can determine an inherent risk value for each grouping based on risk data associated with the grouping. The computing system can generate a risk forecasting model of residual risk for each grouping. The residual risk can be an amount of riskiness remaining after control strength values of the risk controls are applied to the inherent risk value. The computing system can output the risk forecasting model for display on a graphical user interface.

Abstract: Relative risk in a network system can be determined according to some examples. For example, a system can receive a plurality of risk data for a plurality of risk factors within a network. The system can determine a hierarchy of groupings for the plurality of risk factors. The system can determine a plurality of associations between the plurality of risk data and a plurality of predetermined risk controls. Each predetermined risk control can represent an amount of control for reducing the riskiness of a risk factor. The system can determine a risk assessment for each grouping of the hierarchy of groupings based on the plurality of risk data, the plurality of predetermined risk controls, and the hierarchy of groupings. The system can output the risk assessment for each grouping of the hierarchy of groupings for display on a user interface.

Abstract: Relative risk in a network system can be determined according to some examples. For example, a computing system can determine a hierarchy of groupings for risk factors within a network based on risk data associated with the risk factors. The computing system can determine associations between the risk data and the risk controls. Each risk control can represent an amount of control for reducing riskiness of a risk factor. The computing system can determine a risk assessment for each grouping of the hierarchy of groupings based on the risk data, the risk controls, and the hierarchy of groupings. Determining the risk assessment can include determining a control coverage for each grouping based on the associations and the risk data. The computing system can output the risk assessment for each grouping of the hierarchy of groupings for display on a graphical user interface.