# Scoring the Unscorables: Cyber Risk Assessment Beyond Internet Scans

arXiv: https://arxiv.org/abs/2506.06604 · HTML: https://mlsanity.com/paper/2506.06604/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 49 references that are in the map.
- First posted on arXiv 7 Jun 2025.

## Builds on (most cited first, 10 of 10)

- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Exploit Prediction Scoring System (EPSS)](https://mlsanity.com/paper/1908.04856/) (2019)
- [Early Stage Malware Prediction Using Recurrent Neural Networks](https://mlsanity.com/paper/1708.03513/) (2017)
- [Tiresias: Predicting Security Events Through Deep Learning](https://mlsanity.com/paper/1905.10328/) (2019)
- [Technical Report -- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits](https://mlsanity.com/paper/2102.07869/) (2021)
- [Scanning the Internet for ROS: A View of Security in Robotics Research](https://mlsanity.com/paper/1808.03322/) (2018)
- [Inscriptis -- A Python-based HTML to text conversion library optimized for knowledge extraction from the Web](https://mlsanity.com/paper/2108.01454/) (2021)
- [Enhancing Vulnerability Prioritization: Data-Driven Exploit Predictions with Community-Driven Insights](https://mlsanity.com/paper/2302.14172/) (2023)

## Abstract (arXiv)

In this paper we present a study on using novel data types to perform cyber risk quantification by estimating the likelihood of a data breach. We demonstrate that it is feasible to build a highly accurate cyber risk assessment model using public and readily available technology signatures obtained from crawling an organization's website. This approach overcomes the limitations of previous similar approaches that relied on large-scale IP address based scanning data, which suffers from incomplete/missing IP address mappings as well as the lack of such data for large numbers of small and medium-sized organizations (SMEs). In comparison to scan data, technology digital signature data is more readily available for millions of SMEs. Our study shows that there is a strong relationship between these technology signatures and an organization's cybersecurity posture. In cross-validating our model using different cyber incident datasets, we also highlight the key differences between ransomware attack victims and the larger population of cyber incident and data breach victims.