Skip to content
EKG Catalog
Cybersecurity
EKGF/ekg-catalog

Cybersecurity

Cybersecurity Contexts Cloud Security Context OT/ICS Security Context SaaS Security Context Detect (Cybersecurity Monitoring) Anomaly & Behavior Detection Detection Engineering Logging & Telemetry SOC Monitoring & Alerting Threat Hunting Threat Intelligence Govern (Cybersecurity Governance) Compliance, Controls & Audit Evidence Cyber Risk Management Security Architecture & Standards Security Strategy & Policy Third-Party & Supply Chain Security Risk Identify (Cybersecurity Understanding) Attack Surface Management Data Classification & Criticality Threat Modeling & Scenario Mapping Vulnerability Management Protect (Cybersecurity Controls) Application & API Security Backup & Resilience Controls Data Protection Identity & Access Management (IAM) Network Security & Segmentation Privileged Access Management (PAM) Secure Configuration & Hardening Security Awareness & Training Recover (Cybersecurity Recovery) Backup Restore & Integrity Validation Disaster Recovery (DR) & Business Continuity (BCP) Resilience Improvements Service Restoration Respond (Cybersecurity Incident Response) Communications & Disclosure Containment & Eradication Incident Intake & Triage Investigation & Forensics Lessons Learned & Improvement Technology Estate Inventory
Cybersecurity Contexts Cloud Security Context OT/ICS Security Context SaaS Security Context Detect (Cybersecurity Monitoring) Anomaly & Behavior Detection Detection Engineering Logging & Telemetry SOC Monitoring & Alerting Threat Hunting Threat Intelligence Govern (Cybersecurity Governance) Compliance, Controls & Audit Evidence Cyber Risk Management Security Architecture & Standards Security Strategy & Policy Third-Party & Supply Chain Security Risk Identify (Cybersecurity Understanding) Attack Surface Management Data Classification & Criticality Threat Modeling & Scenario Mapping Vulnerability Management Protect (Cybersecurity Controls) Application & API Security Backup & Resilience Controls Data Protection Identity & Access Management (IAM) Network Security & Segmentation Privileged Access Management (PAM) Secure Configuration & Hardening Security Awareness & Training Recover (Cybersecurity Recovery) Backup Restore & Integrity Validation Disaster Recovery (DR) & Business Continuity (BCP) Resilience Improvements Service Restoration Respond (Cybersecurity Incident Response) Communications & Disclosure Containment & Eradication Incident Intake & Triage Investigation & Forensics Lessons Learned & Improvement Technology Estate Inventory
New to this diagram? Learn about the method: Use Case Tree · Use Case · Outcome

Cybersecurity covers the capabilities needed to reduce business risk from cyber threats: understand what must be protected, prevent and detect attacks, respond effectively to incidents, and recover quickly while meeting regulatory and customer expectations.

Cybersecurity is a business capability: it protects revenue, customer trust, operational continuity, and regulatory standing. This tree organizes the key capabilities in a way that helps business analysts and stakeholders discuss scope, ownership, outcomes, and dependencies.

Outcomes

  • Reduced likelihood and impact of cyber incidents
  • Faster detection and response, with clearer accountability
  • Improved audit readiness and evidence quality
  • Better prioritization of security investments based on business criticality
  • Increased resilience and faster recovery for critical services

Components

  • Govern — operating model, policies, risk, compliance
  • Identify — understand assets, exposures, and scenarios
  • Protect — preventative controls and risk reduction
  • Detect — monitoring, alerting, and investigation triggers
  • Respond — incident handling and communications
  • Recover — restoration, continuity, and resilience

GenAI-enabled execution

GenAI can accelerate security work by delegating well-scoped tasks to highly specialised autonomous agents (e.g., triage assistant, evidence collector, policy mapper, incident scribe). These agents must be guardrailed by approved scope, explicit approvals for high-impact actions, and traceable provenance of every claim and artifact. An EKG can provide the authoritative context (assets, owners, dependencies, controls, incidents, policies) that keeps agent actions relevant and auditable.