{"id":"https://openalex.org/W4414122477","doi":"https://doi.org/10.1109/access.2025.3609252","title":"A Novel Risk-Based Methodology for Enhancing Industrial Control Systems Security: A Systematic Review and Case Study","display_name":"A Novel Risk-Based Methodology for Enhancing Industrial Control Systems Security: A Systematic Review and Case Study","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414122477","doi":"https://doi.org/10.1109/access.2025.3609252"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3609252","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3609252","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"review","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3609252","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Aar\u00f3n David Echeverr\u00eda L\u00f3pez","orcid":null},"institutions":[{"id":"https://openalex.org/I2799978770","display_name":"X-Fab (Germany)","ror":"https://ror.org/030bh9196","country_code":"DE","type":"company","lineage":["https://openalex.org/I2799978770"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Aar\u00f3n David Echeverr\u00eda L\u00f3pez","raw_affiliation_strings":["Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica; Universidad de M&#x00E1;laga, M&#x00E1;laga, Spain","Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica, Universidad de M&#x00E1;laga, M&#x00E1;laga, Espa&#x00F1;a"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica; Universidad de M&#x00E1;laga, M&#x00E1;laga, Spain","institution_ids":["https://openalex.org/I2799978770"]},{"raw_affiliation_string":"Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica, Universidad de M&#x00E1;laga, M&#x00E1;laga, Espa&#x00F1;a","institution_ids":["https://openalex.org/I2799978770"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000171675","display_name":"Mercedes Amor","orcid":"https://orcid.org/0000-0001-7190-0581"},"institutions":[{"id":"https://openalex.org/I2799978770","display_name":"X-Fab (Germany)","ror":"https://ror.org/030bh9196","country_code":"DE","type":"company","lineage":["https://openalex.org/I2799978770"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Mercedes Amor Pinilla","raw_affiliation_strings":["Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica; Universidad de M&#x00E1;laga, M&#x00E1;laga, Spain","Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica, Universidad de M&#x00E1;laga, M&#x00E1;laga, Espa&#x00F1;a"],"raw_orcid":"https://orcid.org/0000-0001-7190-0581","affiliations":[{"raw_affiliation_string":"Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica; Universidad de M&#x00E1;laga, M&#x00E1;laga, Spain","institution_ids":["https://openalex.org/I2799978770"]},{"raw_affiliation_string":"Escuela T&#x00E9;cnica Superior de Ingenier&#x00ED;a Inform&#x00E1;tica, Universidad de M&#x00E1;laga, M&#x00E1;laga, Espa&#x00F1;a","institution_ids":["https://openalex.org/I2799978770"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5079110081","display_name":"Henry Carvajal Mora","orcid":"https://orcid.org/0000-0003-0529-8224"},"institutions":[{"id":"https://openalex.org/I69094615","display_name":"Universidad San Francisco de Quito","ror":"https://ror.org/01r2c3v86","country_code":"EC","type":"education","lineage":["https://openalex.org/I69094615"]}],"countries":["EC"],"is_corresponding":false,"raw_author_name":"Henry Ramiro Carvajal Mora","raw_affiliation_strings":["Colegio de Ciencias e Ingenier&#x00ED;as &#x201C;El Polit&#x00E9;cnico,&#x201D; Universidad San Francisco de Quito USFQ, Quito, Ecuador","Colegio de Ciencias e Ingenier&#x00ED;as \"El Polit&#x00E9;cnico\",, Universidad San Francisco de Quito (USFQ), Diego de Robles S/N, Quito, Ecuador"],"raw_orcid":"https://orcid.org/0000-0003-0529-8224","affiliations":[{"raw_affiliation_string":"Colegio de Ciencias e Ingenier&#x00ED;as &#x201C;El Polit&#x00E9;cnico,&#x201D; Universidad San Francisco de Quito USFQ, Quito, Ecuador","institution_ids":["https://openalex.org/I69094615"]},{"raw_affiliation_string":"Colegio de Ciencias e Ingenier&#x00ED;as \"El Polit&#x00E9;cnico\",, Universidad San Francisco de Quito (USFQ), Diego de Robles S/N, Quito, Ecuador","institution_ids":["https://openalex.org/I69094615"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.06944444,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":null,"first_page":"160313","last_page":"160339"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9470000267028809,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9470000267028809,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.618399977684021},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.49729999899864197},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4921000003814697},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.48899999260902405},{"id":"https://openalex.org/keywords/critical-infrastructure-protection","display_name":"Critical infrastructure protection","score":0.4438000023365021},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.4390999972820282},{"id":"https://openalex.org/keywords/risk-management","display_name":"Risk management","score":0.435699999332428},{"id":"https://openalex.org/keywords/critical-infrastructure","display_name":"Critical infrastructure","score":0.40119999647140503},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.39719998836517334},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.3716999888420105}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7135000228881836},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.618399977684021},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5685999989509583},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5066999793052673},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.49729999899864197},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4921000003814697},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.48899999260902405},{"id":"https://openalex.org/C2779033394","wikidata":"https://www.wikidata.org/wiki/Q5186733","display_name":"Critical infrastructure protection","level":3,"score":0.4438000023365021},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.4390999972820282},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.435699999332428},{"id":"https://openalex.org/C29852176","wikidata":"https://www.wikidata.org/wiki/Q373338","display_name":"Critical infrastructure","level":2,"score":0.40119999647140503},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.39719998836517334},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.3716999888420105},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.3671000003814697},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.3614000082015991},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.3433000147342682},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3384999930858612},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.3345000147819519},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.33180001378059387},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.3188000023365021},{"id":"https://openalex.org/C116537","wikidata":"https://www.wikidata.org/wiki/Q2169973","display_name":"Service provider","level":3,"score":0.31540000438690186},{"id":"https://openalex.org/C172862783","wikidata":"https://www.wikidata.org/wiki/Q5165888","display_name":"Control system security","level":5,"score":0.3043999969959259},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.30169999599456787},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.28870001435279846},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.28690001368522644},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2865000069141388},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.2847000062465668},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.28299999237060547},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.28189998865127563},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.2793000042438507},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.26910001039505005},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C17520342","wikidata":"https://www.wikidata.org/wiki/Q7797190","display_name":"Threat","level":5,"score":0.2572999894618988},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.25060001015663147}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3609252","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3609252","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:cc4a58fcec944782a0d4b0b2bf1a7eba","is_oa":true,"landing_page_url":"https://doaj.org/article/cc4a58fcec944782a0d4b0b2bf1a7eba","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 160313-160339 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3609252","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3609252","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4949918980","display_name":null,"funder_award_id":"33617","funder_id":"https://openalex.org/F4320326549","funder_display_name":"Universidad San Francisco de Quito"}],"funders":[{"id":"https://openalex.org/F4320326549","display_name":"Universidad San Francisco de Quito","ror":"https://ror.org/01r2c3v86"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":121,"referenced_works":["https://openalex.org/W110007310","https://openalex.org/W1983442091","https://openalex.org/W2044123990","https://openalex.org/W2056327323","https://openalex.org/W2129586531","https://openalex.org/W2295108256","https://openalex.org/W2535070354","https://openalex.org/W2602506815","https://openalex.org/W2614996178","https://openalex.org/W2620817009","https://openalex.org/W2746818848","https://openalex.org/W2762320476","https://openalex.org/W2763362521","https://openalex.org/W2765362015","https://openalex.org/W2767180070","https://openalex.org/W2786245267","https://openalex.org/W2792015048","https://openalex.org/W2793129310","https://openalex.org/W2801778295","https://openalex.org/W2808266100","https://openalex.org/W2810757304","https://openalex.org/W2883434603","https://openalex.org/W2886566865","https://openalex.org/W2887902581","https://openalex.org/W2890609107","https://openalex.org/W2892303285","https://openalex.org/W2898411077","https://openalex.org/W2899541238","https://openalex.org/W2900066043","https://openalex.org/W2900145066","https://openalex.org/W2906861472","https://openalex.org/W2907794021","https://openalex.org/W2908595482","https://openalex.org/W2943298666","https://openalex.org/W2948502305","https://openalex.org/W2952612473","https://openalex.org/W2954633544","https://openalex.org/W2956260132","https://openalex.org/W2958923081","https://openalex.org/W2972568755","https://openalex.org/W2980035252","https://openalex.org/W2990623250","https://openalex.org/W2997066694","https://openalex.org/W3008587543","https://openalex.org/W3012250252","https://openalex.org/W3019791958","https://openalex.org/W3023115323","https://openalex.org/W3030186388","https://openalex.org/W3037372341","https://openalex.org/W3049401039","https://openalex.org/W3089016417","https://openalex.org/W3096143714","https://openalex.org/W3100688814","https://openalex.org/W3110197631","https://openalex.org/W3111454524","https://openalex.org/W3112099458","https://openalex.org/W3130705826","https://openalex.org/W3142490413","https://openalex.org/W3152184839","https://openalex.org/W3166357681","https://openalex.org/W3173714054","https://openalex.org/W3174321497","https://openalex.org/W3182921601","https://openalex.org/W3185103244","https://openalex.org/W3186508261","https://openalex.org/W3186548119","https://openalex.org/W3192233533","https://openalex.org/W4200077037","https://openalex.org/W4200162376","https://openalex.org/W4200167643","https://openalex.org/W4206005545","https://openalex.org/W4210344620","https://openalex.org/W4210904635","https://openalex.org/W4211100545","https://openalex.org/W4212937412","https://openalex.org/W4214829033","https://openalex.org/W4224297428","https://openalex.org/W4229799221","https://openalex.org/W4230668220","https://openalex.org/W4231439413","https://openalex.org/W4231973052","https://openalex.org/W4236393653","https://openalex.org/W4250435031","https://openalex.org/W4256269622","https://openalex.org/W4284890209","https://openalex.org/W4285982397","https://openalex.org/W4293868383","https://openalex.org/W4300002915","https://openalex.org/W4307038924","https://openalex.org/W4308479228","https://openalex.org/W4308823590","https://openalex.org/W4312746502","https://openalex.org/W4312863479","https://openalex.org/W4313131486","https://openalex.org/W4313481358","https://openalex.org/W4315926821","https://openalex.org/W4322624235","https://openalex.org/W4322769595","https://openalex.org/W4352978954","https://openalex.org/W4360585416","https://openalex.org/W4360604963","https://openalex.org/W4360833903","https://openalex.org/W4366320137","https://openalex.org/W4366332468","https://openalex.org/W4380030985","https://openalex.org/W4383316367","https://openalex.org/W4383739237","https://openalex.org/W4385366999","https://openalex.org/W4385655814","https://openalex.org/W4386881452","https://openalex.org/W4387140220","https://openalex.org/W4387381608","https://openalex.org/W4387490183","https://openalex.org/W4388202756","https://openalex.org/W4388280364","https://openalex.org/W4388482923","https://openalex.org/W4388571881","https://openalex.org/W4389100344","https://openalex.org/W4392181116","https://openalex.org/W4400579829","https://openalex.org/W4401110878"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Critical":[0],"infrastructures":[1,231],"support":[2],"essential":[3],"services":[4],"across":[5,128],"various":[6],"sectors,":[7],"including":[8],"finance,":[9],"energy,":[10],"healthcare,":[11],"and":[12,30,80,92,146,157,172,188,221],"public":[13],"administration.":[14],"However,":[15],"their":[16],"increasing":[17],"exposure":[18],"to":[19,112,137,142,151,197,225],"the":[20,57,135,177,185,192,205,216,227],"internet,":[21],"combined":[22],"with":[23],"insecure":[24],"communication":[25,174],"protocols,":[26],"weak":[27],"authentication":[28],"mechanisms,":[29],"misconfigurations,":[31],"makes":[32],"them":[33],"prime":[34],"targets":[35],"for":[36,51,61,125,179,208],"cyber":[37,234],"threats.":[38,235],"To":[39],"address":[40],"these":[41],"risks,":[42,156],"this":[43],"paper":[44],"presents":[45],"a":[46,97,108,122,138],"novel":[47],"cybersecurity":[48],"methodology":[49,124,136],"tailored":[50],"Industrial":[52],"Control":[53],"Systems":[54],"(ICS),":[55],"leveraging":[56],"Shodan":[58],"search":[59],"engine":[60],"systematic":[62,109],"vulnerability":[63],"identification.":[64],"The":[65,162,202],"proposed":[66,193],"approach":[67],"integrates":[68],"six":[69],"key":[70],"phases:":[71],"IP":[72],"discovery":[73],"(1),":[74],"DNS":[75],"verification":[76],"(2),":[77],"port,":[78],"protocol":[79],"service":[81],"identification":[82],"(3),":[83],"operating":[84],"system":[85],"profiling":[86],"(4),":[87],"web":[88],"application":[89],"analysis":[90],"(5),":[91],"comprehensive":[93],"risk":[94,99,126,190,222],"assessment":[95,127],"using":[96],"customized":[98],"matrix":[100],"(6).":[101],"This":[102],"study":[103,141],"contributes":[104],"by":[105],"(1)":[106],"conducting":[107],"literature":[110],"review":[111],"identify":[113,153],"gaps":[114],"in":[115,212],"existing":[116],"ICS":[117,130,213],"security":[118,160,166,181,210],"frameworks,":[119],"(2)":[120],"developing":[121],"structured":[123],"different":[129],"lifecycle":[131],"phases,":[132],"(3)":[133],"applying":[134],"real-world":[139],"case":[140],"validate":[143],"its":[144,149],"effectiveness,":[145],"(4)":[147],"demonstrating":[148],"capability":[150],"systematically":[152],"vulnerabilities,":[154],"quantify":[155],"provide":[158],"actionable":[159],"insights.":[161],"results":[163],"reveal":[164],"critical":[165,230],"gaps,":[167],"such":[168],"as":[169],"outdated":[170],"software":[171],"unencrypted":[173],"channels,":[175],"emphasizing":[176],"need":[178,207],"improved":[180],"controls.":[182],"By":[183],"quantifying":[184],"attack":[186],"surface":[187],"assessing":[189],"levels,":[191],"model":[194],"enables":[195],"stakeholders":[196],"prioritize":[198],"remediation":[199],"efforts":[200],"effectively.":[201],"findings":[203],"highlight":[204],"urgent":[206],"proactive":[209],"measures":[211],"environments,":[214],"reinforcing":[215],"importance":[217],"of":[218,229],"continuous":[219],"monitoring":[220],"mitigation":[223],"strategies":[224],"enhance":[226],"resilience":[228],"against":[232],"evolving":[233]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}
