A Digital Twin to Improve Cyber-Social Impact

Digital twins can help predict real-world consequences of cyberattacks beyond technical damage: The framework simulates attacks on critical infrastructure in virtual environments to understand broader societal impacts, moving beyond traditional security metrics (CIA triad) that only measure data confidentiality, integrity, and availability.

A new scoring system quantifies social impact alongside technical vulnerability: The Cyber-Social Vulnerability Scoring System (CSVSS) extends existing vulnerability metrics to include social dimensions—such as effects on specific communities and geographic areas—producing a single score that reflects actual harm to people and society, not just systems.

Human experts must remain in control of critical security decisions: Rather than automating risk assessment, the framework uses AI (an LLM) to perform initial analysis and generate reports, but requires human analysts to validate findings and make final decisions, ensuring accountability and preventing over-reliance on automated systems.

This approach addresses a critical gap in cybersecurity for essential services: By modeling how cyberattacks on industrial control systems affect both operations and communities, the framework helps protect critical infrastructure like power grids and water systems where failures have direct human consequences.

Explainable AI supports rather than replaces human judgment: The system provides transparent reasoning for its initial assessments, allowing analysts to understand and verify AI recommendations before making decisions about real-world security responses.