AI-driven optimisation of cybersecurity vulnerability remediation planning
Maximum risk reduction through patching – within your operational downtime limits, without simultaneous interference with core systems and taking patch compatibilities into account.
- Objective : Prioritised patch list with maximum risk reduction
- Constraint : e.g. ≤ 40 hours of downtime per month
- Rules : Core systems not in parallel, mutual exclusions, dependencies
- Framework : CVSS + asset criticality + exploit availability
Why traditional prioritisation often fails
In enterprise environments, patching is a decision-making task subject to constraints. Maintenance windows are limited, downtime is costly, systems are interdependent and not every patch is compatible with other changes.
Simply sorting by CVSS or using a static top-10 list rarely leads to the maximum possible risk reduction within the given time budget. What matters is not the highest individual value, but the optimal combination subject to operational constraints.
Mathematical modelling of the patching decision
StratePlan models patch selection as a 0-1 optimisation problem (knapsack with constraints). Each patch i can either be implemented (xᵢ = 1) or deferred (xᵢ = 0).
Assessment Inputs
- CVSS Base Score (0–10)
- Asset Criticality Weight (Business Criticality)
- Estimated Downtime per Patch (hours)
- Exploit Availability (Temporal Metric)
Risk Reduction Score
For each vulnerability i, a risk reduction score is defined as:
sᵢ = CVSSᵢ × Criticalityᵢ
Optionally, exploit availability is integrated as an additional factor, depending on your security policy.
Optimisation objective
max Σ sᵢ · xᵢ
Constraints
- Downtime budget : Σ dᵢ · xᵢ ≤ 40 hours/month (configurable)
- Core system rule : No simultaneous patches in defined core systems
- Compatibility rules : Mutual exclusions and dependencies
- Extended vector constraints : Resources, locations, maintenance windows
Result: An actionable patch plan with maximum impact
The result is not a list of scores, but a concrete, actionable patch selection that achieves the greatest possible risk reduction within your downtime limit.
- Transparent decision-making logic
- Reproducible selection
- Audit- and governance-ready documentation
- Measurable risk reduction metrics
The basis is the CVSS framework for the standardised assessment of vulnerabilities. Selection optimisation is carried out using StratePlan as a 0-1 knapsack model with multiple constraints (vector constraints).
This calculates,
from a multitude of competing patches exactly that subset which, under real operational conditions
If you need to take downtime, core system rules and compatibilities into account, simple prioritisation by score is not sufficient.
StratePlan delivers a well-founded patch plan, which achieves maximum risk reduction within your operational limits.
Common Patterns Across Cases
Assessment
Qualitative and quantitative factors are converted into comparable scores – using scales, evaluation models or structured expert assessment. The aim is to establish a consistent, decision-ready evaluation basis.
Ranking
Elements are prioritised. However, ranking is rarely the final decision. In complex environments, prioritisation is frequently embedded directly into a combinatorial optimisation process in order to systematically account for interactions and constraints.
Group Selection
The final selection goes beyond a simple ‘Top-k’ approach. StratePlan solves structured selection problems such as knapsack, portfolio or scheduling models and calculates the optimal combination under real-world constraints.
Constraints
Constraints reflect real-world scarcity: capital, time, resources, risk appetite, regulatory requirements, strategic mandates or sustainability requirements. They are an integral part of the decision-making logic.
Technologies
Hybrid use of MCDA methods (e.g. AHP, TOPSIS) for structured evaluation combined with StratePlan for constraint-aware group or portfolio selection.
These cases demonstrate how StratePlan evolves decision-making processes from pure ranking to intelligent, constraint-aware portfolio construction. Evaluation data is translated into actionable, optimised group decisions – aligned with financial, strategic and sustainability-related objectives.
The underlying core logic – structured evaluation → quantitative prioritisation → constrained group selection – scales across different sectors and is adapted in each case to domain-specific success metrics and constraints.
