Risk assessment methodologies in Cybersecurity - Time & Space Complexity

Time Complexity: Risk assessment methodologies

O(n x m)

Understanding Time Complexity

Analyzing time complexity helps us understand how long a risk assessment process might take as the number of assets or threats grows.

We want to know how the effort increases when assessing more risks.

Scenario Under Consideration

Analyze the time complexity of the following risk assessment steps.

for each asset in assets:
    for each threat in threats:
        evaluate_risk(asset, threat)
        record_result
    end
end

This code checks every threat against every asset to evaluate risks.

Identify Repeating Operations

• Primary operation: Nested loops over assets and threats.
• How many times: For each asset, all threats are checked once.

How Execution Grows With Input

As the number of assets and threats grows, the total checks grow by multiplying these numbers.

Input Size (assets x threats)	Approx. Operations
10 assets x 5 threats	50 risk evaluations
100 assets x 50 threats	5,000 risk evaluations
1,000 assets x 200 threats	200,000 risk evaluations

Pattern observation: The total work grows quickly as both assets and threats increase, multiplying together.

Final Time Complexity

Time Complexity: O(n x m)

This means the time needed grows proportionally to the number of assets times the number of threats.

Common Mistake

[X] Wrong: "Checking risks for one asset means the total time grows only with the number of assets."

[OK] Correct: Because each asset must be checked against all threats, the total time depends on both assets and threats, not just one.

Interview Connect

Understanding how risk assessment scales shows you can think about workload and efficiency, a useful skill in cybersecurity roles.

Self-Check

"What if we only assessed risks for a fixed number of top threats instead of all threats? How would the time complexity change?"