AI-Driven Cyber Risk Prediction and Its Impact on Enterprise Risk Management

Abstract

Enterprise risk management (ERM) treats cyber risk as a category to be rated, prioritised and reported, but the ratings that feed it are usually derived from vulnerability severity scores that ignore how assets are actually exposed and used. This paper examines whether AI-driven prediction of asset-level incidents improves the prioritisation on which ERM depends. A simulation of 5,000 assets generates incidents from a process in which severity, external exposure, patch age, privilege level, traffic and patch lag interact, and compares a gradient-boosting risk model with a severity-only ranking. The AI model attains an AUC of 0.76 against 0.60 for severity ranking and nearly doubles average precision. Under a remediation budget covering 10% of assets, it prevents 27% of incidents against 15%; at 30% coverage, 59% against 40%. The paper translates these gains into ERM terms, showing how predicted incident probabilities replace ordinal ratings, how remediation budgets can be set against prevented loss, and how the prediction layer connects operational security data to the risk register. It also identifies the conditions on which the gains depend, including labelled incident history and stable attack patterns, and proposes governance for the prediction model as an ERM control. The contribution is a demonstration that AI prediction changes not only what security teams fix first but how cyber risk is represented and resourced at the enterprise level.