Business Analytics for Cybersecurity Vulnerability Prioritization in Banking: Evidence from EPSS, CVSS, and CISA KEV | JPES
JPES Journal Logo Platform
Back to Archive
Research Article Portal Node

Business Analytics for Cybersecurity Vulnerability Prioritization in Banking: Evidence from EPSS, CVSS, and CISA KEV

Author(s) Registry Raguvaran V
Volume RegistryVol 1
Issue ContextIssue 02
Published Timestamp14 Oct 2026
Digital DOI Handle*

Abstract

The fast increase in the number of cyber threats faced in today's banking sector calls for smart algorithms capable of prioritizing the detected vulnerabilities timely and accurately. This paper proposes a business analytics model that utilizes the evidence from Exploit Prediction Scoring System (EPSS), Common Vulnerability Scoring System (CVSS), and the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (CISA KEV) catalogue for enhanced decision-making in managing the vulnerabilities in the banking environment. The central component of the proposed model is represented by the hybrid algorithm architecture that uses the representation learning power of the Heterogeneous Graph Transformer (HGT) along with the clustering capacity of the Self-Organizing Map (SOM) and the ability of the Isolation Forest to detect anomalies. By combining the advantages of all these approaches, the model obtains a good combination of the capacity to model the relational dependencies between vulnerabilities, to detect latent patterns and the ability to isolate anomalous signals. Experimental analysis performed using the real-world banking datasets shows the high accuracy of 97.40%, which proves the efficiency of the model for ranking and prioritizing the vulnerabilities that require urgent addressing. Besides its efficiency, the proposed business analytics model makes an important contribution to the field. The proposed model shows how machine learning can be made consistent with the business goals so that limited resources are allocated to those vulnerabilities that are most likely to be exploited. In essence, such a solution makes business analytics a bridge between technical assessment and executive decision-making in the banking field.

Keywords

Business AnalyticsCybersecurityVulnerability ManagementBanking IndustryExploit Prediction Scoring System (EPSS)Common Vulnerability Scoring System (CVSS)CISA Known Exploited Vulnerability (KEV)Heterogeneous Graph Transformer (HGT)Self Orga

References (17)

  1. Shingleton, Jarrod, and Elisabeth Paté‐Cornell. "Cyber Resilience: Management With Cybersecurity Controls." Risk Analysis 46.7 (2026): e70299. 02 July 2026, https://doi.org/10.1111/risa.70299
  2. Ansari, Mohammad Samar, and Umadevi Chenniyampallam Rajan. "Cybersecurity risk management in it projects: a systematic review and classification of risks, best practices, and framework effectiveness (2020-2025)." Best Practices, and Framework Effectiveness (2020- 2025)(January 07, 2026) (2026).
  3. Woods, Daniel W., and Sezaneh Seymour. "Evidence-based cybersecurity policy? A meta-review of security control effectiveness." Journal of Cyber Policy 8.3 (2023): 365-383.
  4. De la Cruz Huaman, Robin Willans. Evaluación de modelos de Machine Learning para la priorización inteligente de vulnerabilidades en el sector bancario. Diss. UNIVERSIDAD ESAN, 2025.
  5. Renney, H., Chenchiah, I. V., Nethercott, M., Paligadu, R., & Lang, J. (2025). An open and adaptable approach to vulnerability risk scoring. J. Cyber Secur, 7(1), 221-238. International Journal of Progressive Engineering Studies, 01(2), 86-93, 2026 8
Scholarly Citation Asset

Business Analytics for Cybersecurity Vulnerability Prioritization in Banking: Evidence from EPSS, CVSS, and CISA KEV

Raguvaran V, "Business Analytics for Cybersecurity Vulnerability Prioritization in Banking: Evidence from EPSS, CVSS, and CISA KEV," Journal of Progressive Engineering Studies (JPES), vol. 1, no. 2, pp. 87-94, 2026.