The ISC International Journal of Information Security

Abstract Existing cybersecurity frameworks suffer from static threat assessment, inadequate modeling of system dependencies, oversimplified risk propagation, and inflexible countermeasure selection. This study presents a data-driven, multi-agent decision-support framework that optimizes countermeasure selection under operational constraints. The approach employs a dynamic graph structure representing relationships among missions, tasks, assets, threats, vulnerabilities, and countermeasures, with weighted dependencies across confidentiality, integrity, and availability dimensions. The framework comprises a modular architecture of ten specialized agents—namely the Main (serving as the Environment Controller agent), Node, Edge, Mission, Task, Asset, Threat, Vulnerability, Countermeasure, and Mapping Agents—organized into four functional categories (Control, Structural, Mission-Centric, and Security-Focused). These agents collaboratively operate through four sequential phases: (1) Data Gathering and Graph Construction, (2) Weight Propagation and Risk Assessment, (3) Multi-Criteria Optimization, and (4) Implementation and Reassessment. Experimental results demonstrate substantial improvements in risk mitigation efficiency and resource allocation compared to conventional approaches, enabling organizations to dynamically align security investments with evolving threats, mission priorities, and budget constraints while maintaining operational continuity.

Abstract Selecting optimal cybersecurity countermeasures requires integration with mission-critical objectives beyond technical risk minimization. This paper presents a mission-centric framework for countermeasure selection in cybersecurity situation awareness systems by extending the RiskMAP methodology with agent-based and discrete-event simulation. The framework employs a multi-criteria decision-making approach based on the Confidentiality, Integrity, and Availability (CIA) triad, weighing mission objectives and mapping vulnerabilities and threats using MITRE ATT&CK and D3FEND taxonomies. Candidate countermeasures are evaluated considering risk reduction, implementation cost, operational impact, and mission alignment. We demonstrate the approach through a case study on a critical infrastructure organization’s network modeled in AnyLogic. Results show improved alignment between security posture and organizational priorities while maintaining effective risk reduction, outperforming traditional methods. This framework enables quantitative visualization and optimization of security investments relative to mission continuity. All simulation models, data, and scripts are openly available to support reproducibility.