Attacker Economics for Internet-scale Vulnerability Risk Assessment

Vulnerability risk assessment is a crucial process in security management, and the CVSS score is the standard-de-facto risk metric for software vulnerabilities. In this manuscript I show that current risk assessment methodologies do not fit real "in the wild" attack data. I also present my three-steps plan to identify an Internet-scale risk assessment methodology that accounts for attacker economics and opportunities. Eventually, I want to provide answers like the following: "If we deploy this security measure, the fraction of our users affected by this type of cyber attacks will be less than X%".