  Proactive cyber-risk assessment is gaining momentum due to the wide range of
sectors that can benefit from the prevention of cyber-incidents by preserving
integrity, confidentiality, and the availability of data. The rising attention
to cybersecurity also results from the increasing connectivity of
cyber-physical systems, which generates multiple sources of uncertainty about
emerging cyber-vulnerabilities. This work introduces a robust statistical
framework for quantitative and qualitative reasoning under uncertainty about
cyber-vulnerabilities and their prioritisation. Specifically, we take advantage
of mid-quantile regression to deal with ordinal risk assessments, and we
compare it to current alternatives for cyber-risk ranking and graded responses.
For this purpose, we identify a novel accuracy measure suited for rank
invariance under partial knowledge of the whole set of existing
vulnerabilities. The model is tested on both simulated and real data from
selected databases that support the evaluation, exploitation, or response to
cyber-vulnerabilities in realistic contexts. Such datasets allow us to compare
multiple models and accuracy measures, discussing the implications of partial
knowledge about cyber-vulnerabilities on threat intelligence and
decision-making in operational scenarios.
