SIH26105: AI-Powered Continuous Cyber Risk Quantification and Investment Optimization Plat — SIH 2026 | Wynit

SIH26105: AI-Powered Continuous Cyber Risk Quantification and Investment Optimization Plat — SIH 2026 | Wynit

What they'll ask you

13

Generated from the brief's own wording and the competition's published rules, never from a guess about what this ministry prefers.

What specific mock security tools or APIs must be integrated for the demo?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
What specific financial formulas or baseline cost parameters should be used for loss calculations?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.
What exact dataset format the platform needs to parse during evaluation?
The brief never answers this, so a panel will. Whatever you decide, say it the same way twice.

10 morethe ones a panel gets to if there is time

Has any part of this been shown at a previous event, hackathon or college project?
The guidelines are explicit: your solution must not have appeared in any previous event or programme, of any sort. A recycled project is what a team under time pressure reaches for.
The brief asks for risk quantification engine. How would you build that?
Decoded from SIH26105 itself: Aggregates security telemetry to calculate financial exposure metrics and model asset criticality. The brief asks for it by name.
The brief asks for ai decision support layer. How would you build that?
Decoded from SIH26105 itself: Provides predictive analytics, mitigation recommendations, a natural language query interface, and scenario simulations. The brief asks for it by name.
The brief asks for investment optimization module. How would you build that?
Decoded from SIH26105 itself: Calculates return on security investment and recommends controls that maximize risk reduction within a budget. The brief asks for it by name.
The brief asks for executive and technical dashboards. How would you build that?
Decoded from SIH26105 itself: Displays enterprise risk scores, financial exposure, trends, and drill-down views for technical teams. The brief asks for it by name.
The brief asks for compliance framework mapping. How would you build that?
Decoded from SIH26105 itself: Maps findings to frameworks like ISO 27001, NIST, CIS, RBI, and SEBI to generate audit reports. The brief asks for it by name.
Where does your data come from: a published source, one you collect, or one you generate?
No dataset is attached to this problem statement, so sourcing it is part of the work and nobody told you that.
Why not use what already exists? Name the closest thing to this that is already running.
A team that has not named the alternative themselves is answering this for the first time in the room.
Which single thing will you demonstrate end to end, start to finish, with nothing skipped?
Ours, not a rule: a narrow thing that fully works survives questioning better than a broad thing that half works. If nobody on the team can name it, that is the finding.
Show me this working: the jury will check if your platform successfully ingests telemetry from multiple security tools, computes realistic financial exposure numbers like Expected Annual Loss, optimizes spending under budget constraints, and accurately maps risks to specified frameworks like NIST and ISO.
This is the evaluator read for your problem statement, decoded from the brief's own wording.

The government's original description (785 words)

• Background Enterprises and institutions invest heavily in cybersecurity tools, compliance programs, and risk management initiatives, yet cyber risk is still predominantly communicated using qualitative ratings such as 'Low','Medium', or 'High'. These coarse categories fail to express the potential financial impact of cyber threats,making it difficult for senior management, boards, and regulators to evaluate whether current cyber investments are adequate or optimally allocated. Cyber risk is inherently dynamic: new vulnerabilities emerge, threat actors change tactics, business services are added or retired, and security controls mature over time. Most current risk assessment practices rely on periodic, manual exercises, resulting in stale risk registers and limited visibility into the organizationâ€™s real-time cyber exposure. This gap leads to suboptimal prioritization of remediation efforts, under- or over-spending on security controls, and weak alignment between technical risk metrics and business decision-making. • Problem Statement Design and develop an AI-powered platform that continuously quantifies cyber risk in monetary terms by correlating technical security telemetry with business asset criticality and control effectiveness. The platform must estimate the likelihood and financial impact of cyber incidents, identify key risk drivers, and recommend cost-effective mitigation strategies under explicit budget constraints.The solution should bridge the gap between technical cybersecurity metrics and business language, enabling CISOs, risk officers, and executive leadership to make informed, data-driven decisions about cyber risk and security investment. • Proposed Solution Develop a cloud-ready cyber risk analytics platform that ingests data from multiple enterprise security and IT sourcesâ€”such as vulnerability management, SIEM, IAM, EDR, CSPM, asset inventories, and threat intelligence feedsâ€”and uses AI/ML models to compute continuous risk scores and estimated financial exposure, such as Expected Annual Loss. The system should provide interactive dashboards and decision-support tools that allow stakeholders to simulate remediation scenarios, evaluate investment options, and understand the return on security investment.The platform must be capable of mapping risk metrics to established cybersecurity frameworks, including ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, RBI Cyber Security Framework, and SEBI Cybersecurity and Cyber Resilience Framework, supporting both regulatory reporting and internal governance. • Key Components • Risk Quantification Engine o Continuous aggregation and normalization of data from vulnerability scanners, SIEM, IAM, EDR,CSPM, asset inventory, and other security tools. o Statistical and ML-based estimation of incident likelihood and potential business impact, including downtime costs, data breach costs, regulatory penalties, and reputational effects. o Calculation of enterprise cyber risk as financial exposure metrics (for example, Expected Annual Loss and Value at Risk) at organization, business unit, and asset levels. o Asset criticality modeling to weigh technical findings based on business importance and service dependencies. o Control effectiveness evaluation using telemetry about configuration strength,incident history, and compliance status. • AI Decision Support Layer o Predictive analytics for emerging threats and evolving risk based on trends in vulnerabilities, threat intelligence, and control performance. o AI-generated mitigation recommendations that propose prioritized actionsâ€”such as patch deployment, access control tightening, network segmentation, and additional monitoringâ€”with quantified risk reduction. o Natural language query interface for non-technical stakeholders, enabling questions like 'What is our highest financial cyber risk today?' or 'Which vulnerabilities contribute most to our expected losses?'. o Scenario simulation tools for exploring 'what-if' analyses, such as 'What happens if MFA is implemented across all privileged accounts?' or 'How will delaying remediation by 30 days affect our financial exposure?'. • Investment Optimization Module o Optimization models that recommend sets of controls and remediation actions delivering maximum risk reduction for a specified budget (for example, ?1 crore). o Computation of ROSI and cost-benefit metrics for different security initiatives to support strategic planning and board-level approvals. o Visualization of 'Investment vs. Risk Reduction' curves to highlight diminishing returns and optimal spend zones. • Executive and Technical Dashboards o Unified views for CISOs and executives, including Enterprise Risk Score, total Financial Exposure, Risk Trend Analysis, Top Risk Contributors, and Risk Reduction Opportunities. o Drill-down capability for technical teams to see control-level and asset-level findings, remediation backlogs, and mapping to frameworks and policies. • Compliance and Framework Mapping o Built-in mapping against frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, RBI Cyber Security Framework, and SEBI Cybersecurity and Cyber Resilience Framework. o Support for generating evidence-based reports and dashboards for audits, regulatory filings, and internal governance committees. • Expected Outcomes • Continuous, near real-time visibility into enterprise cyber risk, expressed in monetary terms understandable to business stakeholders. • Improved prioritization of cybersecurity initiatives based on quantified impact rather than subjective risk ratings. • Enhanced communication of cyber risk to executive management, boards, and regulators through intuitive, data-driven dashboards and narratives. • More rational and optimized cybersecurity investment decisions, maximizing risk reduction per unit of spend. • Reduction in both the likelihood and financial impact of cyber incidents through targeted remediation and investment strategies.