GCRI · Cybersecurity and Digital Resilience
Reviewed models and scenarios
Model descriptions for Cybersecurity and Digital Resilience are published here once reviewed, with their assumptions, evidence and validation. They describe models; they are not live simulations.
The workspace for reviewed models and scenarios.
Build workspace
Cybersecurity · Reviewed models · Run R-0690 · Example interface, not a record
Runs
same inputs, versioned
| R-6303 | Cybersecurity | v9.4 | 0.48 | Running |
| R-9012 | Software | v4.1 | 0.76 | Drift |
| R-4212 | Communications | v8.0 | 0.79 | Passed |
| R-9490 | Network science | v3.4 | 0.71 | Drift |
Model card
- Method
- Cybersecurity and cryptography
- Inputs
- SIEM alerts, Asset inventory
- Validation
- held-out period, skill reported
- Label
- MODELLED
Run log
- 00:00:15InfoIngest SIEM alerts
- 00:03:12InfoSchema and licence checks passed
- 00:07:40WarnGap filled by interpolation, flagged
- 00:12:03DoneCalibration complete
- 00:20:55GateIndependent test queued
Cybersecurity and Digital Resilience · Build workspace. Build workspace: example names and illustrative values, not a record.
Released, referenced and rights-cleared.
- Time and space reference for every view.
- Sources and licence.
- Uncertainty and known limits.
- Version and date of release.
The kinds of model cyber work relies on.
| Model class | Open examples | Question it answers | Validation |
|---|---|---|---|
| Attack-path analysis | MITRE ATT&CK-based modelling | How adversaries reach critical assets | Red-team exercises |
| Accumulation scenarios | Catastrophe-style cyber scenarios | Correlated losses across organisations | Past large incidents |
| Dependency network models | Provider dependency graphs | Concentration and cascade | Outage records |
| Vulnerability prioritisation | CVSS with exploitation data such as KEV | Which vulnerabilities to fix first | Exploitation records |
How the process runs.
Process explorer · Process
Reviewed models and scenarios: Hazard, exposure, vulnerability
10 steps·4 stages
Process
Reviewed models and scenarios: Hazard, exposure, vulnerability
In IPCC AR6 Working Group II, climate risk results from interactions between hazards and a system's exposure and vulnerability, and responses can add risk.
01 Drivers
- 01HazardDataset · Security operations centreThe potential occurrence of a natural or human-induced physical event or trend that may harm people, property, services or ecosystems.
- 02ExposureDataset · Security operations centreThe presence of people, livelihoods, species, ecosystems, infrastructure or assets in places and settings that could be adversely affected.
- 03SensitivityDataset · Security operations centreThe degree to which a system or species is affected, either adversely or beneficially, by climate variability or change.
- 04Capacity to cope and adaptDataset · Security operations centreThe ability of systems, institutions, humans and other organisms to adjust to damage, take opportunities or respond to consequences.
02 Assessment
- 05Risk from responsesComponent · Security operations centreRisks from climate responses arise when responses miss their objectives, or from trade-offs or negative side effects.
- 06VulnerabilityComponent · Security operations centreThe propensity or predisposition to be adversely affected. It includes sensitivity to harm and lack of capacity to cope and adapt.
- 07RiskModel · Cybersecurity and Digital ResilienceRisk results from dynamic interactions between hazards and the system's exposure and vulnerability. Each may be uncertain and change.
03 Response
- 08Risk management and responseStep · Security operations centreRisk management is plans, actions, strategies or policies that reduce the likelihood or size of adverse consequences.
- 09Residual riskRecord · Security operations centreThe climate impact risk that remains after adaptation and mitigation efforts. Adaptation can redistribute risk between areas and groups.
04 Decision
- 10Decision by the responsible partyDecision · Security operations centreThe framing names no single decision maker. Decisions on responses rest with the responsible party under its own rules.
Outline of an external standard or method, from its public sources. It describes what the framework says, not a record of any run. It does not show that Nexus or any partner performs, certifies or approves a step. A gate is a step of the method, never a Nexus approval.
Releases appear as they are reviewed.
Analysis runs in Foundry; reviewed releases are listed here.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Can I request a map or model?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.