Application of Analytical Network Processing (ANP) Method in Ranking Cybersecurity Metrics

Since the advent of the Internet and digital technology, every organization uses digital tools to conduct its daily business. Finding new threats and vulnerabilities and calculating their influence on an organization's operations are the key goals of cybersecurity. To have strong cybersecurity in place, it is important to have some kind of mechanism to measure it. Metrics are used to measure something that has no direct method/instrument to measure. Cybersecurity metrics refer to the quantitative and qualitative measurements used to assess the effectiveness, efficiency, and overall health of an organization's cybersecurity efforts. By leveraging multi-criteria decision-making (MCDM) techniques in cybersecurity, organizations can improve their decision-making processes, optimize resource allocation, and enhance their overall cybersecurity posture to better defend against evolving cyber threats. Therefore, the purpose of this study is to model cybersecurity metrics evaluation by developing a decision network using analytical network process (ANP). The identification of various criteria is very important. Security metrics are organized into five primary classes divided down into 15 sub-classes, and these 15 sub-classes are further subdivided into 29 sub-classes.