• The study introduces a novel framework FABRICS - Fault tree And Bayesian Risk & Impact analysis for Cyber Security - that combines Bayesian fault tree models with business impact analysis to quantify cyber risk both in terms of likelihood and financial impact. • The framework employs a structured elicitation process to gather expert judgments from both cybersecurity and business experts. • The framework was applied in a real insurance company, involving over 20 experts across cybersecurity and business domains analyzing a data breach and operational downtime. • The framework supports executive-level reporting, return on investment calculation, cyber insurance negotiations, and capital adequacy assessments. This study presents a model for financially quantifying an organization's cyber risk by analysing scenarios in which critical business processes are compromised. Financial impact and likelihood of a cyber incident remain difficult to quantify due to several challenges: scarcity of reliable data, limited methods for effectively incorporating expert judgment in lieu of objective data, threat landscape uncertainty, and the inherently interrelated cyber risks that lead to incidents. To be meaningful and actionable, any cyber risk analysis must be tailored to the organization's specific characteristics. This includes identifying relevant threats, assessing the effectiveness of existing controls, and evaluating the financial value of affected processes. Our proposed framework addresses these requirements by evaluating threats and control failure probabilities, and financial impact of cyber scenarios, with particular emphasis on reputational costs—an aspect frequently overlooked in prior research. The novelty of our approach lies in the integration of several methods: a) Business Impact Analysis to identify the most relevant cyber scenarios and their associated losses, b) expert elicitation techniques to capture collective uncertainty regarding the likelihood and financial consequences of cyber incidents, and c) Bayesian Fault Tree Analysis combined with Monte Carlo simulations to estimate scenario probabilities. We refer to this integrated framework as FABRICS, Fault tree And Bayesian Risk & Impact analysis for Cyber Security, a novel framework that synthesizes structured risk modeling with expert-driven uncertainty assessment. We demonstrate its practical application through a real-world case study involving an insurance company.

Protecting against cyber-threats is essential for every organization and can be achieved by investing in cybersecurity controls and purchasing cyber insurance. These two alternatives are interlinked, as insurance premiums can be reduced by investing more in cybersecurity controls. However, cyber insurance remains under-utilized, a puzzle that Expected Utility Theory (EUT) cannot explain. In this paper, we analyze how decision-makers allocate resources between cybersecurity controls and cyber insurance, comparing optimal allocation under Prospect Theory (PT) to that under EUT. We propose a new functional form of risk curves to model the relationship between investment in cybersecurity controls and cyber risk , demonstrating how a bespoke risk curve can be fitted for an organization. We derive the optimal allocation strategy of resources to cybersecurity controls and cyber insurance under EUT and PT paradigms. Using mathematical results and numerical examples, we identify specific behavioral considerations in PT that lead to different resource allocations compared to EUT. We show that decision-makers aligned with EUT are generally indifferent to purchasing insurance, whereas those aligned with PT favor full insurance coverage; otherwise, they invest more in self-protection. Our results indicate that, in addition to a challenging cybersecurity environment and the nature of insurance coverage, behavioral aspects (diminished sensitivity to losses and probability weights) play a key role in determining the optimal level of investment in cybersecurity.

High value data like historical or health records, seismic or satellite images, particle collision events or original recordings, requires a long-term storage medium that is resilient, scalable, secure, and computable. DNA has been proposed as a solution and storage has been demonstrated using basewise synthesis. Separately, DNA computing demonstrations have shown complex programs executed on small datasets. Here, we demonstrate a new unified approach to DNA-based data storage and computing. We describe a novel combinatorial assembly approach to writing data into DNA. We define a trie-like DNA data structure and use it to write data in key-value form. We demonstrate our approach by writing The Complete Works of William Shakespeare —about 1 million words of text—into DNA with raw error rates rivaling conventional media. Leveraging our DNA data structure, we define two new computing instructions— select and quotient —and using them, demonstrate how DNA-encoded text could be searched for exact or approximate matches to a query word. Our search demonstrations achieve perfect recall and high precision. Our approach is more scalable in cost and throughput that previous approaches and our platform is extensible to more powerful computing instructions applicable to a variety of applications.

The distribution of farm locations and sizes is paramount to characterize patterns of disease spread. With some regions undergoing rapid intensification of livestock production, resulting in increased clustering of farms in peri-urban areas, measuring changes in the spatial distribution of farms is crucial to design effective interventions. However, those data are not available in many countries, their generation being resource-intensive. Here, we develop a farm distribution model (FDM), which allows the prediction of locations and sizes of poultry farms in countries with scarce data. The model combines (i) a Log-Gaussian Cox process model to simulate the farm distribution as a spatial Poisson point process, and (ii) a random forest model to simulate farm sizes (i.e. the number of animals per farm). Spatial predictors were used to calibrate the FDM on intensive broiler and layer farm distributions in Bangladesh, Gujarat (Indian state) and Thailand. The FDM yielded realistic farm distributions in terms of spatial clustering, farm locations and sizes, while providing insights on the factors influencing these distributions. Finally, we illustrate the relevance of modelling realistic farm distributions in the context of epidemic spread by simulating pathogen transmission on an array of spatial distributions of farms. We found that farm distributions generated from the FDM yielded spreading patterns consistent with simulations using observed data, while random point patterns underestimated the probability of large outbreaks. Indeed, spatial clustering increases vulnerability to epidemics, highlighting the need to account for it in epidemiological modelling studies. As the FDM maintains a realistic distribution of farm location and sizes, its use to inform mathematical models of disease transmission is particularly relevant for regions where these data are not available.

A new class of prior distributions that can be used to assess the sensitivity of the Bayesian posterior inference to uncertainty in the data is proposed. This class is derived starting from an initial prior distribution and the likelihood function. We establish the mathematical properties of this class and the conditions under which ordering can be established within this class. We show how the sensitivity analysis can be performed using a standard MCMC procedure for any model whose likelihood, or an approximation, is available in a closed form and illustrate using examples. We also discuss how the proposed class is connected to the main ideas behind the Approximate Bayesian Computation (ABC) method. For this reason, we choose to call the new class of prior distributions as the ABC class of prior distributions. Finally, we close by sketching further possible extensions to this work.

Target detection (TD) in spectral imagery is an evolving analytical perspective with broader application potential. The perceived distinctness of the spectral signatures of the materials of interest is exploited for detecting targets in hyperspectral imagery. Space-time varying atmospheric perturbances on the radiation reaching a remote sensor are major limitations for designing a successful TD framework. Incorporating atmospheric components into a target detection framework is vital for practical applicability. Considered a general approach for flexibility, scalability, and optimal prediction, deep learning (DL) methods are increasingly used in various remote sensing applications. However, their potential for TD is relatively unexplored. Especially, the ability to provide training data sufficient for DL models and maintaining the functional relevance of the sparsely distributed targets in hyperspectral imagery are crucial for TD frameworks. This letter presents a novel method for training of DL architecture, called Deep Spectral Target Detector (DSTD). The proposed method includes a semi-supervised multi-scenario forward radiative transfer modelling (RTM) for the simulation of spectral signatures of various targets as training data suitable for the functional requirements of a typical DL architecture. We implemented the DSTD on a TD application-specific benchmark AVIRIS-NG airborne hyperspectral imagery acquired over a study site near Ooty, India. Compared to state-of-art statistical target detectors, the detection performance of the DSTD is superior to equivalent. Further, RTM-based training yields a robust model, impervious to the atmospheric mismatches between target collection and TD environments, indicating the potential for a similar approach to developing efficient DL-based methods for TD in the future.

Insider threats entail major security issues in many organizations. Game theoretic models of insider threats so far proposed do not take into account important factors such as the organizational culture and whether the attacker was detected or not. They also fail to model defensive mechanisms already put in place by an organization to mitigate insider attacks. We propose two new models which incorporate these settings and, hence, are more realistic, and use adversarial risk analysis to find their solutions. Our models and solutions are general and can be applied to most insider threat scenarios. A data security example illustrates the discussion.

In this paper, we present a novel application where Human-Computer Interaction (HCI) meets Artificial Intelligence (AI) and discuss obstacles that need to be resolved on the long journey from research to production. Unlike academia and industries that have been at the forefront of automation for decades, government is a new player in the field, though an important one. We build systems that are used on a large scale, we collect data to inform policymakers. Using the example of the Household Budget Survey, we demonstrate how government agencies can apply Human-in-the-Loop AI to automate the production of official statistics. The aim is time and resource saving on repetitive, labour-intensive tasks which machines are good at, allowing humans to focus on value added tasks requiring flexibility and intelligence. One major challenge is the human factor. How will the users, who are accustomed to manual tasks, react to the complexity of AI? How should we design the interface to give them a good user experience? How do we measure success? Indeed, one key step towards production is to secure funding, which requires presenting potential success in a way that the stakeholder can understand. Stressing the importance of formulating problems from a practical business viewpoint, we hope to bridge the communication gap and help the research community reach out to more potential users and help solve more novel real-world problems.

We propose a prior robustness approach for the Bayesian implementation of the fault tree analysis (FTA). FTA is often used to evaluate risk in large, safety critical systems but has limitations due to its static structure. Bayesian approaches have been proposed as a superior alternative to it, however, this involves prior elicitation, which is not straightforward. We show that minor misspecification of priors for elementary events can result in a significant prior misspecification for the top event. A large amount of data is required to correctly update a misspecified prior and such data may not be available for many complex, safety critical systems. In such cases, prior misspecification equals posterior misspecification. Therefore, there is a need to develop a robustness approach for FTA, which can quantify the effects of prior misspecification on the posterior analysis. Here, we propose the first prior robustness approach specifically developed for FTA. We not only prove a few important mathematical properties of this approach, but also develop easy to use Monte Carlo sampling algorithms to implement this approach on any given fault tree with and and/or or gates. We then implement this Bayesian robustness approach on two real-life examples: a spacecraft re-entry example and a feeding control system example. We also provide a step-by-step illustration of how this approach can be applied to a real-life problem.