AI-Driven Automated Cyber Risk Assessment Pipeline for GRC Intelligence – A Tripartite Framework

Maniyan, Kaviya (2025) AI-Driven Automated Cyber Risk Assessment Pipeline for GRC Intelligence – A Tripartite Framework. Masters thesis, Dublin, National College of Ireland.

Preview	PDF (Master of Science) Download (1MB) | Preview
Preview	PDF (Configuration Manual) Download (783kB) | Preview

Abstract

In this digital era, cybersecurity risk management became a crucial challenge that should be addressed as soon as possible to avoid more dangerous effects. Every year thousands of new vulnerabilities are released, yet organizations struggle to interpret, disclose and understand how these threats relate to specific attack behaviors and compliance controls. Most of the studies were dependent on small sampling, CVSS metrics and rule-based approaches. This research proposes a novel AI-driven tri-partite (CVE -> MITRE -> NIST) automation framework by developing hybrid machine learning and deep learning models to classify CVE vulnerabilities as well as rule-free embeddings. Sentence-BERT was used to embed descriptions (text) of all three datasets and to train a hybrid MLP that achieved ~82% accuracy, ~0.72 macro F1 across the long NVD test cases. Cosine similarity has been generated for CVE -> MITRE, MITRE -> NIST, CVE -> NIST mapping to rank top k exploitation and mitigation knowledge. A visual tri-partite knowledge graph using NetworkX was created and an interactive assistant was trained, which inputs both CVE IDs and free-text vulnerability description that maps them with top k NIST and MITRE frameworks it also provides standard NIST controls (top 3) to each attack technique. Therefore, this proposed system transforms raw information into GRC intelligence in seconds rather than traditional methods.

Item Type:	Thesis (Masters)
Supervisors:	Name Email Chikkankod, Arjun UNSPECIFIED
Subjects:	H Social Sciences > HD Industries. Land use. Labor > HD61 Risk Management Q Science > QH Natural history > QH301 Biology > Methods of research. Technique. Experimental biology > Data processing. Bioinformatics > Artificial intelligence Q Science > Q Science (General) > Self-organizing systems. Conscious automata > Artificial intelligence Q Science > QA Mathematics > Computer software > Computer Security T Technology > T Technology (General) > Information Technology > Computer software > Computer Security
Divisions:	School of Computing > Master of Science in Data Analytics
Depositing User:	Ciara O'Brien
Date Deposited:	08 Sep 2026 09:18
Last Modified:	08 Sep 2026 09:18
URI:	https://norma.ncirl.ie/id/eprint/9880

Actions (login required)

View Item