Cybersecurity Thesis on Risk-based vulnerability prioritization framework for large-scale cloud-native enterprise environments

The thesis will develop a risk-based vulnerability prioritization framework for large-scale cloud-native enterprise environments. It will combine vulnerability severity and exploitation evidence with workload exposure, component source, fix availability, regulatory deadlines such as NIS2, and business service criticality. Small decision tables will assign each vulnerability an action, from “act now” to “mitigate and defer,” with a recorded rationale rather than replacing CVSS with a new score. Following design science research, the framework will be compared with CVSS, an EPSS- and KEV-based method, SSVC, and CISA directive BOD 26-04 using one year of real vulnerability data, with practitioner validation or suitable alternatives considered. The planned title is “Risk-based vulnerability prioritization framework for large-scale cloud-native enterprise environments.

This is a master’s thesis in vulnerability management, focused on identifying and prioritizing security weaknesses in cloud systems and online services. The work should remain technically grounded, without relying entirely on social-engineering or other nontechnical concepts. The client is open to alternative thesis topics within vulnerability management, but does not want to invent a replacement vulnerability-scoring method or write code for a new vulnerability database. Support should cover technical rigor and credible validation, including designing the practitioner-validation study, finding participants, considering alternatives that do not require practitioners, and other suggestions. The university has no stated rules on external research or AI assistance beyond its prohibition on plagiarism. The client has papers ready for literature review and analysis.

Expertise:
Cybersecurity and vulnerability management
Risk assessment and risk-based vulnerability prioritization
Cloud security and cloud-native environments
Strong research and analytical skills
Master’s-level academic writing

Using design science research, the work will review vulnerability-prioritization methods and papers the client has ready for analysis, develop decision rules, and check them for gaps and contradictions. The framework will be compared with CVSS, an EPSS- and KEV-based method, SSVC, and CISA directive BOD 26-04 using one year of real vulnerability data, then tested with practitioners. The client has not yet identified practitioners and is open to advice on how to recruit or use them for validation, or whether that stage can be omitted.