Ensuring cybersecurity assurance in complex digital environments increasingly requires a risk-based approach, where resource allocation, control implementation, and monitoring are guided by the potential impact of threats and system vulnerabilities rather than prescriptive compliance checklists. Risk-based cybersecurity assurance prioritizes the protection of critical assets, balances security investments against operational requirements, and incorporates probabilistic assessments of threat likelihood and severity. A key dimension of this approach is data availability, which directly influences decision-making, operational continuity, and the reliability of automated risk assessments. Despite advances in cybersecurity frameworks and monitoring technologies, organizations continue to face limitations in data completeness, timeliness, and quality. Inadequate or fragmented data can impede accurate risk modeling, delay detection of emerging threats, and reduce the effectiveness of control strategies, particularly in distributed, cloud-enabled, and high-velocity digital ecosystems. Recent advances address some of these challenges through the integration of real-time telemetry, behavioral analytics, and AI-driven anomaly detection. These technologies enable continuous assessment of system state and user activity, improving the granularity and predictive power of risk models. Additionally, the adoption of probabilistic and scenario-based methodologies allows organizations to quantify uncertainty, model cascading effects, and anticipate potential disruptions even under incomplete information. However, gaps remain in standardizing data collection, ensuring data integrity across multi-source environments, and integrating data-driven insights into actionable governance and policy frameworks. Future research opportunities include the development of autonomous, adaptive cybersecurity assurance systems that leverage AI-native risk assessment, cross-domain data integration, and continuous feedback loops. There is also a need for empirical validation of risk-based models in diverse operational contexts, exploration of data availability trade-offs, and methods for resilient decision-making under uncertainty. Advancing these areas will enhance the effectiveness of risk-based cybersecurity assurance, improve organizational resilience, and support sustained operational continuity in increasingly complex and interconnected digital systems.
Fadayomi et al. (Sun,) studied this question.