Cyber Resilience Exposure Index (CREI): turning the asset-risk matrix into a decision metric
DOI: https://doi.org/10.3846/btp.2026.25873Abstract
Small and medium-sized enterprises (SMEs) face disproportionate cyber risk exposure due to persistent financial, technical, and human resource constraints. Although cyber resilience has gained increasing attention, SMEs still lack practical quantitative instruments that enable structured measurement, comparison, and management of cyber risk exposure. This paper addresses this gap by proposing a risk-centric quantitative assessment model for SME cyber resilience. The study introduces the Cyber Resilience Exposure Index (CREI), a composite metric designed to quantify cyber risk exposure across critical organizational assets and major cyber risk categories. The index integrates four dimensions: likelihood-impact risk evaluation, weighted cyber risk categories, asset criticality, and cybersecurity control maturity as a mitigating factor. CREI is calculated across an asset-risk matrix and produces sector-comparable scores on a 0–100 scale, where lower exposure indicates higher resilience. Sensitivity analysis demonstrates the robustness of results under different weighting schemes, while a practical scoring guide and illustrative example support immediate SME adoption. The proposed metric operationalizes cyber resilience as a decision-oriented management tool, strengthening investment prioritization and enabling longitudinal benchmarking across sectors.
Keywords:
cyber resilience, cyber risk exposure, small and medium-sized enterprises, risk quantification, composite index, asset-based risk assessment, decision-support modelHow to Cite
Share
License
Copyright (c) 2026 The Author(s). Published by Vilnius Gediminas Technical University.
This work is licensed under a Creative Commons Attribution 4.0 International License.
References
Al-Hawamleh, A. M. (2024). Cyber resilience framework: Strengthening defenses and enhancing continuity in business security. International Journal of Computing and Digital Systems, 15(1), 1315–1331. https://doi.org/10.12785/ijcds/150193
AllahRakha, N. (2024). Cybersecurity regulations for protection and safeguarding digital assets (data) in today’s worlds. Lex Scientia Law Review, 8(1), 405–432. https://doi.org/10.15294/lslr.v8i1.2081
Alshawish, A., & de Meer, H. (2019). Risk mitigation in electric power systems: Where to start? Energy Informatics, 2, Article 34. https://doi.org/10.1186/s42162-019-0099-6
Aven, T. (2016). Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research, 253(1), 1–13. https://doi.org/10.1016/j.ejor.2015.12.023
Aven, T., & Zio, E. (2018). Foundational aspects of risk assessment and risk management. Risk Analysis, 38(1), 1–7.
Bahmanova, A., & Lace, N. (2025a). Aligning SME critical assets with cyber risks using a matrix model to develop a cyber resilience framework. Journal of Systemics, Cybernetics and Informatics, 23(5), 11–16. https://doi.org/10.54808/JSCI.23.05.11
Bahmanova, A., & Lace, N. (2025b). Types of cyber risks for SMEs: Classification and business impact. In V. Davidavičienė, V. Skvarciany, & K. Peleckis (Eds.), Selected Proceedings of the 15th International Scientific Conference “Business and Management 2025” (pp. 484–491). Vilnius Gediminas Technical University. https://doi.org/10.3846/bm.2025.1556
Bahmanova, A., & Lace, N. (2026a). Key factors shaping collaborative cyber resilience in SMEs through open innovation. Journal of Open Innovation: Technology, Market, and Complexity, 12(1), Article 100715. https://doi.org/10.1016/j.joitmc.2026.100715
Bahmanova, A., & Lace, N. (2026b). Modelling cyber resilience in SMEs as a socio-technical system: A systemic approach to adaptive digital risk management. Systems, 14(2), Article 151. https://doi.org/10.3390/systems14020151
Cameron, C., Patsios, C., Taylor, P. C., & Pourmirza, Z. (2019). Using self-organizing architectures to mitigate the impacts of denial-of-service attacks on voltage control schemes. IEEE Transactions on Smart Grid, 10(3), 3010–3019. https://doi.org/10.1109/TSG.2018.2817046
Dhanushkodi, K., & Thejas, S. (2024). AI enabled threat detection: Leveraging artificial intelligence for advanced security and cyber threat mitigation. IEEE Access, 12, 173127–173136. https://doi.org/10.1109/ACCESS.2024.3493957
Duraj, B., Tola, I., & Poshnjari, P., & Perri, R. (2025). Probability of bank distress: Investigating a risk landscape of an emerging economy. Risk Governance and Control: Financial Markets & Institutions, 15(1), 119–129. https://doi.org/10.22495/rgcv15i1p12
European Union Agency for Cybersecurity. (2021). Cybersecurity for SMEs: Challenges and recommendations. Publications Office of the European Union.
European Union Agency for Cybersecurity. (2023). ENISA threat landscape 2023. Publications Office of the European Union. https://doi.org/10.2824/782573
Fisher, R. E., & Porod, C. H. (2023). Enhancing resilience of our Nation’s critical infrastructure. In C. Smith, S. Prescott, & Z. Ma (Eds.), Risk-informed methods and applications in nuclear and energy engineering: Modeling, experimentation, and validation (pp. 205–216). Academic Press. https://doi.org/10.1016/B978-0-323-91152-8.00002-8
Ganin, A. A., Massaro, E., Gutfraind, A., Steen, N., Keisler, J. M., Kott, A., Mangoubi, R., & Linkov, I. (2016). Operational resilience: Concepts, design and analysis. Scientific Reports, 6, Article 19540. https://doi.org/10.1038/srep19540
Guerreiro, S., Guédria, W., Lagerström, R., & Van Kervel, S. J. H. (2017). A meta model for interoperability of secure business transactions – using blockchain and DEMO. In Proceedings of the 9th International Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management (KEOD 2017) (pp. 253–260). SciTePress. https://doi.org/10.5220/0006517502530260
Herranz-Oliveros, D., Tejedor-Romero, M., Gimenez-Guzman, J. M., & Cruz-Piris, L. (2024). Unsupervised learning for lateral-movement-based threat mitigation in active directory attack graphs. Electronics, 13(19), Article 3944. https://doi.org/10.3390/electronics13193944
Huda, S., Islam, M. R., Abawajy, J., Kottala, V. N. V., & Ahmad, S. (2024). A cyber risk assessment approach to federated identity management framework-based digital healthcare system. Sensors, 24(16), Article 5282. https://doi.org/10.3390/s24165282
Ijiga, O. M., Idoko, I. P., Ebiega, G. I., Olajide, F. I., Olatunde, T. I., & Ukaegbu, C. (2024). Harnessing adversarial machine learning for advanced threat detection: AI-driven strategies in cybersecurity risk assessment and fraud prevention. Open Access Research Journal of Science and Technology, 11, 1–4. https://doi.org/10.53022/oarjst.2024.11.1.0060
Jabir, R., Le, J., & Nguyen, C. (2025). Phishing attacks in the age of generative artificial intelligence: A systematic review of human factors. AI 2025, 6(8), Article 174. https://doi.org/10.3390/ai6080174
Kliestik, T., Valaskova, K., Lazaroiu, G., Kovacova, M., & Vrbka, J. (2020). Remaining financially healthy and competitive: The role of financial predictors. Journal of Competitiveness, 12(1), 74–92. https://doi.org/10.7441/joc.2020.01.05
Kopp, E., Kaffenberger, L., & Wilson, C. (2020). Cyber risk measurement: Towards a manageable approach (IMF Working Paper No. 2020/149). International Monetary Fund.
Kure, H. I., & Nwajana, A. O. (2022). Protection of critical infrastructure using an integrated cybersecurity risk management (i-CSRM) framework. In 5G Internet of Things and changing standards for computing and electronic systems (pp. 94–133). IGI Global. https://doi.org/10.4018/978-1-6684-3855-8.ch004
Linkov, I., & Kott, A. (2019). Fundamental concepts of cyber resilience: Introduction and overview. In A. Kott & I. Linkov (Eds), Cyber resilience of systems and networks. Risk, systems and decisions. Springer. https://doi.org/10.1007/978-3-319-77492-3_1
Linkov, I., & Trump, B. D. (2019). The science and practice of resilience. Springer. https://doi.org/10.1007/978-3-030-04565-4
Masud, M. T., Keshk, M., Moustafa, N., Turnbull, B., & Susilo, W. (2025). Vulnerability defence using hybrid moving target defence in Internet of Things systems. Computers & Security, 153, Article 104380. https://doi.org/10.1016/j.cose.2025.104380
Muhammad, A. H., Nasiri, A., & Harimurti, A. (2025). Machine learning methods for classification and prediction information security risk assessment. IAES International Journal of Artificial Intelligence, 14(1), 457–465. https://doi.org/10.11591/ijai.v14.i1.pp457-465
Mustafa, I., McGibney, A., & Rea, S. (2023). Smart contract life-cycle management: An engineering framework for the generation of robust and verifiable smart contracts. Frontiers in Blockchain, 6, Article 1276233. https://doi.org/10.3389/fbloc.2023.1276233
National Institute of Standards and Technology. (2018). Framework for improving critical infrastructure cybersecurity (Version 1.1). U.S. Department of Commerce.
Oughton, E. J., Ralph, D., Pant, R., Leverett, E., Copic, J., Thacker, S., Dada, R., Ruffle, S., Tuveson, M., & Hall, J. W. (2019). Stochastic counterfactual risk analysis for the vulnerability assessment of cyber-physical attacks on electricity distribution infrastructure networks. Risk Analysis, 39(9), 2012–2031. https://doi.org/10.1111/risa.13291
Pavão, J., Bastardo, R., & Rocha, N. P. (2024). Cyber resilience and healthcare information systems, a systematic review. Procedia Computer Science, 239, 149–157. https://doi.org/10.1016/j.procs.2024.06.157
Radanliev, P., De Roure, D. C., Page, K., Nurse, J. R. C., Mantilla Montalvo, R., Santos, O., Maddox, L., & Burnap, P. (2020). Cyber risk at the edge: Current and future trends on cyber risk analytics and artificial intelligence in the industrial internet of things and Industry 4.0 supply chains. Cybersecurity, 3(1), Article 13. https://doi.org/10.1186/s42400-020-00052-8
Rasmussen, J. (1997). Risk management in a dynamic society: A modelling problem. Safety Science, 27(2–3), 183–213. https://doi.org/10.1016/S0925-7535(97)00052-0
Rea-Guaman, M., Calvo-Manzano, J. A., & Feliu, T. S. (2018). A prototype to manage cybersecurity in small companies. In 2018 13th Iberian Conference on Information Systems and Technologies (CISTI) (pp. 1–6). IEEE. https://doi.org/10.23919/CISTI.2018.8399252
Ribeiro, D., Almeida, A., Azevedo, A., & Ferreira, F. (2021, 7–10 September). Resilience in Industry 4.0 digital infrastructures and platforms. In Advances in Manufacturing Technology XXXIV: Proceedings of the 18th International Conference on Manufacturing Research, incorporating the 35th National Conference on Manufacturing Research, University of Derby, Derby, UK (pp. 390–395). SAGE Publications. https://doi.org/10.3233/ATDE210067
Rubakha, M., & Tkachyk, F., Pryimak, I., Demchyshak, N., & Yurkiv, R. (2024). Factor analysis of financial performance and formation of strategic resilience in Ukrainian IT companies under the challenges of war. Financial and Credit Activity: Problems of Theory and Practice, 1(54), 260–281. https://doi.org/10.55643/fcaptp.1.54.2024.4229
Saeed, S., Altamimi, S. A., Alkayyal, N. A., Alshehri, E., & Alabbad, D. A. (2023a). Digital transformation and cybersecurity challenges for business resilience: Issues and recommendations. Sensors, 23(15), Article 6666. https://doi.org/10.3390/s23156666
Saeed, S., Suayyid, S. A., Al-Ghamdi, M. S., Al-Muhaisen, H., & Almuhaideb, A. M. (2023b). A systematic literature review on cyber threat intelligence for organizational cybersecurity resilience. Sensors, 23(16), Article 7273. https://doi.org/10.3390/s23167273
Sarker, I. H., Janicke, H., Mohsin, A., Gill, A., & Maglaras, L. (2024). Explainable AI for cybersecurity automation, intelligence and trustworthiness in digital twin: Methods, taxonomy, challenges and prospects. ICT Express, 10(4), 935–958. https://doi.org/10.1016/j.icte.2024.05.007
Sarfraz, M., Sumra, I. A., Khalid, B., & Fatima, E. (2025). AI-driven predictive threat detection and cyber risk mitigation: A survey. Journal of Computing & Biomedical Informatics, 8(02).
Shafiq, M., Awan, M., Alwageed, H. S., Hassan, M. M., & Khan, R. A. (2026). AI-driven agentic framework for insider threats prevention and detection in secure software development organizations: A fuzzy AHP approach. Research Square. https://doi.org/10.21203/rs.3.rs-8756821/v1
Sheffi, Y. (2005). The resilient enterprise: Overcoming vulnerability for competitive advantage. MIT Press.
Silvestri, S., Islam, S., Amelin, D., Weiler, G., Papastergiou, S., & Ciampi, M. (2024). Cyber threat assessment and management for securing healthcare ecosystems using natural language processing. International Journal of Information Security, 23, 31–50. https://doi.org/10.1007/s10207-023-00769-w
Singh, A., & Dubey, S. K. (2024, March). Analytical approach towards cybersecurity through AI-enabled threat intelligence. In 2024 11th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions) (ICRITO) (pp. 1–6). IEEE. https://doi.org/10.1109/ICRITO61523.2024.10522422
Stoneburner, G., Goguen, A., & Feringa, A. (2002). Risk management guide for information technology systems (NIST Special Publication 800-30). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30
Strandberg, K., Rosenstatter, T., Jolak, R., Nowdehi, N., & Olovsson, T. (2021). Resilient shield: Reinforcing the resilience of vehicles against security threats. In 2021 IEEE 93rd Vehicular Technology Conference (VTC2021-Spring) (pp. 1–7). IEEE. https://doi.org/10.1109/VTC2021-Spring51267.2021.9449029
Taleb, N. N. (2012). Antifragile: Things that gain from disorder. Random House.
Tsuji, D., Fujita, J., Matsumoto, N., Tamura, Y., Doenhoff, J., & Shigemoto, T. (2023). 3-layer modelling method to improve the cyber resilience in industrial control systems. SICE Journal of Control, Measurement, and System Integration, 16(1), 63–74. https://doi.org/10.1080/18824889.2023.2177074
Umunnakwe, A., Sahu, A., Narimani, M. R., Davis, K., & Zonouz, S. (2021). Cyber-physical component ranking for risk sensitivity analysis using betweenness centrality. IET Cyber-Physical Systems: Theory & Applications, 6(3), 139–150. https://doi.org/10.1049/cps2.12010
Veeramany, A., Unwin, S. D., Coles, G. A., Dagle, J. E., Millard, D. W., Yao, J., Glantz, C. S., & Gourisetti, S. N. (2016). Framework for modeling high-impact, low-frequency power grid events to support risk-informed decisions. International Journal of Disaster Risk Reduction, 18, 125–137. https://doi.org/10.1016/j.ijdrr.2016.06.008
Virglerova, Z., Panić, M., Voza, D., & Veličković, M. (2021). Model of business risks and their impact on operational performance of SMEs. Economic Research-Ekonomska Istraživanja, 35(1), 4047–4064. https://doi.org/10.1080/1331677X.2021.2010111
Wai, E., & Lee, C. K. M. (2023). Seamless Industry 4.0 integration: A multilayered cyber-security framework for resilient SCADA deployments in CPPS. Applied Sciences, 13(21), Article 12008. https://doi.org/10.3390/app132112008
Yeboah-Ofori, A., & Islam, S. (2019). Cyber security-resilient supply chain network architecture based on cyber threat intelligence. Computers & Security, 80, 1–17.
Youssef, S. B. H., & Boudriga, N. (2021). A resilient micro-payment infrastructure: An approach based on blockchain technology. Kuwait Journal of Science, 49(1). https://doi.org/10.48129/kjs.v49i1.10578
Zelle, D., Plappert, C., Rieke, R., Scheuermann, D., & Krauß, C. (2022). ThreatSurf: A method for automated Threat Surface assessment in automotive cybersecurity engineering. Microprocessors and Microsystems, 90, Article 104461. https://doi.org/10.1016/j.micpro.2022.104461
View article in other formats
CrossMark check
Published
Issue
Section
Copyright
Copyright (c) 2026 The Author(s). Published by Vilnius Gediminas Technical University.
License
This work is licensed under a Creative Commons Attribution 4.0 International License.