Operationalising cyber risk management: Connecting cyber incidents to MITRE ATT&CK techniques, controls, and metrics

Abstract

The escalating frequency of cyber-attacks poses significant challenges for organisations, particularly small enterprises constrained by limited financial resources. This research presents a novel framework leveraging a knowledge base and Natural Language Processing to address these challenges through automated mapping of cyber incidents to adversary techniques. We introduce the Cyber Catalog, a comprehensive knowledge base that systematically integrates CIS Critical Security Controls, MITRE ATT&CK techniques, and SMART metrics, enabling organisations to connect threat intelligence directly to actionable controls and measurable outcomes. To operationalise the framework, we fine-tuned a general-purpose sentence transformer on an augmented dataset of 74,986 incident-technique pairs to enhance semantic similarity between cyber incidents and MITRE ATT&CK techniques. Our fine-tuned model achieved a Spearman correlation of 0.7894 and Pearson correlation of 0.8756, representing improvements of approximately 0.21 over baseline models including all-mpnet-base-v2, all-distilroberta-v1, and all-MiniLM-L12-v2. The model also exhibited significantly lower prediction errors (MAE = 0.135, MSE = 0.027), confirming superior accuracy and consistency with three-fold reductions compared to baselines. This work bridges the gap between threat intelligence and operational security management, providing an actionable tool for cyber incident response and evidence-based risk management.