Attack-Path-Aware Enterprise Risk Quantification for Cloud-Native Financial Data Platforms Using AI and Cybersecurity Graphs

In the high-stakes world of banking, protecting money and personal data has always been a game of two halves. On one side, security teams use automated scanners to find weaknesses in their computer systems, ranking them by how dangerous they look on paper. On the other side, risk managers try to guess how much money the bank could lose if a hacker succeeds, often relying on rough estimates and colored charts. For decades, these two groups have worked in parallel, rarely speaking the same language. The scanners tell them which single hole is the biggest, while the risk managers worry about the total financial damage. But in modern banking, where data flows through complex cloud networks, a single big hole is rarely the real problem. Instead, a hacker usually succeeds by chaining together a series of small, seemingly harmless steps—like walking through an open door, borrowing a key from a trusted friend, and then slipping into a vault. The critical question is no longer just which hole is biggest, but which chain of small steps actually leads to the most valuable treasure.

A new study by data architect Gopinathan Rathinavelu proposes a way to finally connect these two worlds. The research introduces a system that maps out the entire journey a hacker might take, rather than just looking at isolated weaknesses. By building a digital map of the bank's cloud network, the system traces how an attacker could move from one point to another, tagging each step with known hacking behaviors. It then uses this map to calculate the actual probability of a breach reaching the most sensitive data, known as "crown jewels," and translates that probability into a specific range of potential financial losses. The goal is to help banks decide where to spend their limited security budget to stop the most dangerous paths, rather than just fixing the most obvious flaws.

The researchers built this system to work with the complex, cloud-based data platforms that modern banks use to process transactions and run artificial intelligence models. These platforms are vast and interconnected, making it difficult to see how a weakness in one area, like a third-party vendor connection, could eventually lead to a breach of the main data warehouse. The new architecture starts by gathering real-time information about the bank's security posture, identity permissions, and system configurations. It then constructs a directed graph, a type of map where the nodes represent assets and the lines between them represent possible moves an attacker could make. Each line is tagged with a specific hacking tactic, creating a clear, auditable trail of how an intrusion could unfold.

To make sense of this map, the system uses a specialized form of artificial intelligence to estimate how likely each step in the chain is to succeed. This is done carefully to ensure the results remain transparent and understandable. Where there is enough data, a machine learning model scores the likelihood of a transition; where data is scarce, it falls back on a simpler, transparent calculation or expert judgment. The system also uses language models only to organize unstructured documents, like policy text, into the map's structure, but only after human experts have verified the work. This ensures that the core math behind the risk calculation remains inspectable and reliable, avoiding the "black box" problem where no one knows how a computer reached its conclusion.

Once the map is built and the likelihood of each step is scored, the system runs thousands of simulations to see how often an attacker could reach the crown jewels. Instead of giving a single number, it produces a distribution of possible annual losses, showing both the most likely outcome and the worst-case scenarios. This approach allows risk committees to see the full picture of their financial exposure, including the long tail of rare but catastrophic events that a simple average would miss. The final piece of the puzzle is an optimizer that looks at the available security controls and their costs. It calculates which specific controls, if added, would reduce the expected financial loss the most. This means the system prioritizes fixes based on how much they break the attacker's path, rather than just how severe the individual weakness appears.

The researchers tested this method on a simulated cloud data platform that mimicked a typical financial institution. They created a scenario with thirteen different asset states and eighteen possible attack steps, assigning realistic costs and potential losses to each. In this simulation, the system identified that the most dangerous path to the bank's most valuable data did not come from the most obvious, high-severity vulnerability. Instead, the biggest risk came from a chain of steps involving a third-party vendor integration. Individually, the weaknesses in this path had moderate severity scores, but when chained together, they offered a high-probability route to the crown jewels.

When the researchers compared their new method against the traditional approach of simply fixing the highest-scoring vulnerabilities first, the difference in financial protection was stark. Using a fixed budget of three hundred thousand dollars, the traditional severity-based approach reduced the expected annual loss by about forty-one percent. In contrast, the new path-aware method, which focused on severing the specific chains leading to the crown jewels, reduced the expected loss by eighty-five percent. The system correctly identified that spending money on isolating the third-party vendor and rotating secrets was far more valuable than patching the single highest-rated flaw, which sat on a less likely path to the critical data.

The study concludes that this approach offers a powerful decision-support tool for banks, bridging the gap between technical security findings and financial risk management. It does not replace human judgment or act autonomously; rather, it provides a clear, data-driven argument for why certain controls should be prioritized. By treating risk as a journey rather than a list of points, the method helps organizations understand that the most dangerous threat is often the one that connects the dots, not the one that stands out the most. While the results shown here are based on a synthetic simulation, the framework is designed to be validated against real-world data, offering a path toward more precise and effective financial risk management in an increasingly complex digital world.