Cyber Risk Governance: Predictive Modeling of Indicators for Strategic Decisions in the G (Esg) Pillar

Danieli Juliani Arguero; Elizeu Bandeira De Lima

DOI: 10.22167/2675-6528-202602808

Article derived from a Final Course Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by the Pecege Institute for textual synthesis and organization.

Abstract

The acceleration of digital transformation and the sophistication of threats have elevated cyber risk to a top priority in corporate governance, especially on the ESG agenda. The objective was to propose a conceptual model capable of translating technical cybersecurity data into strategic intelligence for senior management. The model used a framework based on the NIST CSF 2.0, ISO/IEC 27001, and ISO 31000 references, converting audit log events and SIEM platform metrics into predictive risk indicators. The methodology was based on applied research, with a qualitative approach and exploratory objective, outlined by documentary research and structured bibliographic review. Reading sheets and qualitative categorization matrices were used for data collection, whose analysis and triangulation followed Bardin’s Content Analysis method. The results showed a critical informational gap between the reactive technical fronts and the Board of Directors, which requires a forward-looking view for resource allocation. It was found, based on global reports and recent regulatory frameworks, that the transition from a static compliance model to the use of dynamic and behavioral KPIs substantially strengthens corporate resilience. It was concluded that the integration of these predictive metrics equips the board for more agile strategic decisions and enhances the transparency and integrity required in reporting the Governance (G) pillar.

Keywords: Regulatory compliance; Threat intelligence; Behavioral metrics; SIEM platforms; Corporate resilience.

1. Introduction

Digital transformation has redefined business models globally, consolidating interconnectivity as an essential pillar for economic survival. However, this omnipresent digitalization has introduced vulnerabilities that elevate cyber risk from a merely technical problem to a strategic centrality in corporate risk.

In the 2025-2026 biennium, geopolitical volatility and the advancement of generative artificial intelligence created an environment of metamorphic and rapid threats, daily testing companies’ reaction capacity. In parallel, the ESG (Environmental, Social and Governance) agenda gained momentum, driven by investors, regulators, and consumers who demand from organizations a responsibility that transcends traditional financial transparency.

In this ecosystem, the Governance (G) pillar assumes a leading role, encompassing the rigorous supervision of non-financial risks, such as data privacy and cyber resilience. In international markets, regulations like the Digital Operational Resilience Act (European Union, 2022) and the cyber disclosure standards of the Securities and Exchange Commission (SEC, 2023) in the United States, reinforce the direct accountability of senior management and require transparency about the effectiveness of controls.

In Brazil, the enactment of robust legislations, such as the General Data Protection Law (LGPD) and the Securities and Exchange Commission (CVM) Resolution No. 80/2022, has solidified this responsibility. Data protection failure has become a material compliance breach with serious reputational and financial risks. The average cost of a data breach in Brazil reached US$1.36 million in 2024, highlighting the direct impact of digital negligence on companies’ market value.

Widely recognized governance and risk management models, such as COSO ERM (COSO, 2017), COBIT 2019 (ISACA, 2018), and NIST CSF 2.0 (NIST, 2024), consolidate the need for systemic integration between technological risks and corporate governance. Such guidelines reinforce that digital resilience must be treated as an inseparable component of business strategy, requiring a holistic view and metrics that allow for effective oversight by administrators.

However, a critical gap in communication and informational understanding is observed between the operational IT poles and senior management. Although Boards of Directors are legally responsible for overseeing cyber risk, they often lack clear and intelligible metrics to effectively exercise this function.

Traditional technical reports focus on the volume of blocked attacks or infrastructure jargon, which prove ineffective for prospective strategic decision-making. Security management fronts utilize tools such as SIEM (Security Information and Event Management), platforms that collect massive volumes of audit logs and network events.

The central problem lies in the underutilization of the predictive potential of this mass of data, which is traditionally used reactively to detect incidents after they occur. There is a latent disconnect between what analytical logs can reveal about behavioral anomalies and the strategic information needs of senior management. Without clear and prospective indicators, cybersecurity risk management remains stuck in the past, and ESG reporting becomes superficial, based on the mere declarative existence of policies rather than the demonstration of real effectiveness through evidence.

This work is therefore justified by the need to fill this informational gap, proposing a conceptual framework that converts technical logs into predictive Key Performance Indicators (KPIs). The investigation seeks to answer how the intelligent translation of behavioral metadata can strengthen the governance pillar in the ESG agenda, moving companies from a reactive stance to a defense based on real data. Given the above, the general objective of this study was to propose a model capable of synthesizing security events into strategic intelligence, structuring a set of indicators that facilitates decision-making by the Board of Directors and enhances the transparency of corporate reporting.

2. Material and Methods

This research was characterized as a study of an applied nature, with the purpose of generating knowledge directed towards the solution of strategic problems identified in the governance of cyber risks. The methodological approach adopted was qualitative, as recommended by Creswell (2021), who highlights the relevance of qualitative research for the in-depth understanding of social or human problems, allowing for an analysis of processes that would not be captured solely by numerical data.

Regarding the objectives, the study assumed an exploratory character, as it focused on the construction of a new conceptual model. This model was based on secondary and documentary sources. According to the classification proposed by Gil (2017), exploratory research aims to provide greater familiarity with the problem, making it more explicit and facilitating the understanding of its nuances.

The investigative process was organized into two main data collection stages, followed by an integrative analysis phase. The first stage consisted of a structured bibliographic review, conducted to theoretically ground the three central pillars of the work: Corporate Governance, Cybersecurity Risk Management, and Data Science applied to logs and SIEM platforms for predictive modeling.

In this first stage, academic databases focused on scientific literature from the last ten years were explored. The objective was to identify which predictive indicators had already been validated or discussed by academia, establishing a solid foundation for the construction of the proposed model. The search focused on studies that addressed the intersection between these pillars.

The second stage of the research, of a documentary nature, focused on the collection of secondary data. This data was obtained from grey literature and publicly accessible institutional publications, which reflect the most current market practices and the regulatory requirements projected for the 2025-2026 biennium. Documentary research is recognized by Lakatos and Marconi (2021) as a rich and stable source of data, for using documents that have not yet received analytical treatment.

The documentary corpus for analysis was composed of a careful selection of institutional documents and regulatory frameworks. The sampling was intentional, guided by normative relevance, timeliness, and thematic adherence, totaling sixteen main documents. These were subdivided into specific categories to facilitate analysis and information triangulation.

The categories included global risk reports and sector trends (such as World Economic Forum, Gartner, ISACA, PwC, and Brasscom), technical security and governance frameworks (NIST CSF 2.0, ISO/IEC 27001, ISO 31000, COSO ERM, and COBIT 2019), regulatory frameworks and international indices (LGPD, CVM Resolution No. 80/2022, DORA/European Union, SEC, and ITU), and analytical models for measurement and metrics (Kovrr, ManageEngine, and MetricStream).

The instrument used for information collection consisted of reading sheets and qualitative categorization matrices. To ensure the clarity and reliability of the instrument, it was previously reviewed. This review ensured that the analysis categories were aligned with the “Govern” function of the NIST 2.0 framework, which is fundamental for cyber governance.

The validation of documentary sources was based on the institutional authority of the issuers and their indexing in databases recognized by USP/ESALQ. Sustainability and ESG reports from publicly traded companies were also processed to map the existing gaps between what is operationally executed and what is effectively reported to stakeholders. The selection criteria for these documents considered the institutional authority of the source, the regulatory impact, and adherence to the research object.

The treatment and analysis of the data followed the Content Analysis method proposed by Laurence Bardin (2016), operationalized in three distinct poles. Firstly, pre-analysis was carried out, followed by the exploration of the material and, finally, the treatment of the results with inference and interpretation, allowing the extraction of relevant meanings.

In the material exploration phase, the collected information was encoded into specific theoretical cores. These cores were defined as Risk, Metric, and Informational Gap, serving as categories to organize and interpret the data. The qualitative data were synthesized into formats that facilitated information triangulation.

Given the bibliographic and documentary nature of the study, based exclusively on scientific texts and public domain documents that do not reveal individual identification data, the project was exempted from processing by the CEP/CONEP system. This exemption occurred in accordance with the sole paragraph of Article 1 of CNS Resolution No. 510/2016. The ethical use of information was guaranteed, used strictly for academic purposes.

3. Results and Discussion

The analysis of the collected data revealed a significant structural challenge in integrating cyber defense into the high management processes of organizations. The findings suggest that modern governance requires a transition from a merely declarative stance to a defense based on concrete evidence, using indicators that anticipate vulnerabilities before their exploitation. This prospective approach is crucial for mitigating cyber risks and strengthening corporate resilience. The following discussion integrates the threat landscape predicted for 2026, the analytical capabilities of SIEM platforms, and the proposal of a framework for predictive indicators from the perspective of ESG governance.

In accordance with Bardin’s Content Analysis method, the exploration of the documentary material allowed for the coding of evidence from the 16 documents in the corpus into three fundamental theoretical cores. The first core, named “The Risk”, focused on mapping emerging threats, identifying attack surfaces in agentic artificial intelligence, fraud, and quantum risks. Evidence was extracted from reports by organizations such as the World Economic Forum (WEF, 2026), Gartner (2026), PwC (2025), Brasscom (2025), and the International Telecommunication Union (ITU, 2024), underscoring the dynamic and evolving nature of the cyber threat landscape.

The second core, “The Informational Gap”, highlighted the critical disconnection between the technical language used by Security Operations Centers (SOC) and the fiduciary responsibility of the Board of Directors. This gap prevents senior management from fully understanding the extent and impact of cyber risks, hindering strategic decision-making. Documents such as CVM Resolution No. 80/2022 (Brazil, 2022), the General Data Protection Law (LGPD) (Brazil, 2018), the rules of the Securities and Exchange Commission (SEC, 2023), the Digital Operational Resilience Act (European Union, 2022), and ISACA reports (2025) were crucial in identifying this disparity.

The third core, “The Metric”, addressed the need for continuous control structures, log normalization, and the financial quantification of cyber risk. This thematic focus is fundamental for translating technical data into strategic information. Documents associated with this core included the NIST Cybersecurity Framework 2.0 (NIST, 2024), ISO/IEC 27001 and ISO 31000 standards, COSO ERM (COSO, 2017), COBIT 2019 (ISACA, 2018), and analytical models from Kovrr (2025), ManageEngine (2025), and MetricStream (2026). These references provide the basis for developing predictive indicators and integrating cybersecurity into corporate governance.

Global and Local Threat Landscape (2025-2026)

The cyber landscape for 2026 is marked by an unprecedented acceleration of risks, driven by advances in artificial intelligence and geopolitical fragmentation, which redefine the boundaries of digital defense. The Global Cybersecurity Outlook 2026 from the World Economic Forum (WEF, 2026) indicated that cyber fraud has surpassed ransomware as the primary concern for senior executives, shifting the focus from direct extortion to the systematic manipulation of data and identities. An alarming figure revealed that 73% of global leaders were directly or indirectly affected by digital fraud in the past year, highlighting the epidemic nature of this attack vector.

In Brazil, the scenario presents a notable paradox: the country is recognized as a model of regulatory and technical commitment in the Global Cybersecurity Index (ITU, 2024), reaching the Tier Performance – T1: Role-modelling level. However, national companies remain vulnerable due to a predominantly reactive stance. The average cost of data breaches in the Brazilian market saw a significant increase, positioning itself as the third largest global growth in 2024. Brasscom (2025) projects that cybersecurity investments in Brazil will total R$ 104.6 billion between 2025 and 2028, representing a growth of 43.8%, which indicates capital allocation, but the persistence of the internal maturity challenge.

The trends for 2026, identified by Gartner (2026), highlight that agentic artificial intelligence (Agentic AI) requires urgent supervision, as AI agents can autonomously initiate processes and access sensitive information, creating an attack surface that many CISOs (Chief Information Security Officers) are still unable to manage or visualize. Quantum computing, once a long-term concern, has become a security planning necessity with a horizon for 2030. Cryptographic agility is now a strategic priority to prevent Harvest Now, Decrypt Later attacks, according to analyses.

The main strategic risks identified for the 2025-2026 biennium include cyber fraud and phishing, which have a significant operational and reputational impact, being the primary concern of CEOs and representing a breach of customer trust. Agentic AI presents a technological and systemic impact, generating ungoverned automations that can violate compliance and laws. These risks require special attention from governance to ensure integrity and compliance.

Next-generation ransomware, with AI-assisted attacks, impacts financially and business continuity, as it reduces detection and response time, requiring a more proactive approach. Quantum computing, in turn, represents a strategic, long-term risk, demanding immediate cryptographic agility in planning to protect sensitive data. Finally, geopolitical instability generates external and supply chain risks, manifesting in state-sponsored attacks targeting critical infrastructures, which requires robust governance for the protection of essential assets (Gartner, 2026; WEF, 2026).

The Convergence between SIEM, Logs, and Predictive Modeling

Security Information and Event Management (SIEM) platforms are the core of corporations’ detection infrastructure, functioning as aggregators that collect audit metadata from multiple sources, such as servers, endpoints, cloud networks, and physical security devices. However, market analysis reveals that most companies use SIEM only for reactive monitoring and the generation of isolated alerts. The true governance opportunity lies in using these logs for User and Entity Behavior Analytics (UEBA), transforming reactive data into predictive intelligence.

Audit logs contain vital components for predictive modeling, such as timestamps, identity information, event types, and volumes of data moved. When this data is fed into Machine Learning models, such as Random Forest or XGBoost algorithms, the accuracy in detecting anomalies that precede an incident can reach 98%. This allows management to identify weak risk signals, such as an unusual attempt to access sensitive data at atypical times or the lateral movement of high-privilege accounts, before the attack materializes as a catastrophic breach.

However, Security Operations Center (SOC) teams are overwhelmed by alerts and the scarcity of qualified talent. About 66% of professionals report increasing stress and alert overload (ISACA, 2025), and the volume of false positives consumes resources that should be dedicated to strategic analysis. For this reason, governance must require indicators that measure efficiency and not just the quantity of logs processed. Outcome-based metrics, such as Alert Correlation Efficiency (ACE), demonstrate whether the system is generating actionable intelligence or just operational noise, focusing on detection quality.

Governance (G) in ESG and the NIST 2.0 Framework

The integration of cybersecurity into the ESG agenda is an irreversible transformation, with the Governance (G) pillar acting as the natural channel for this union, as cybersecurity underpins the credibility of corporate reporting. If systems tracking carbon emissions or workforce data are compromised, the integrity of the entire ESG report is lost. The publication of version 2.0 of the NIST Cybersecurity Framework in 2024 consolidated this vision by introducing the “Govern” function as a central pillar, requiring organizations to define their risk appetite and align their cyber strategy with the expectations of external stakeholders, such as regulators and investors.

In Brazil, CVM Resolution No. 80/2022 (Brazil, 2022) established rigorous transparency standards for securities issuers, requiring that material cyber incidents and risk management strategies be clearly disclosed. This elevates cybersecurity from an IT support function to a fiduciary responsibility of the board of directors and the council. Modern governance demands Continuous Control Monitoring, ensuring that compliance is not an annual static snapshot but a real-time flow of actual evidence, the distinctions of which from operational models are crucial for effectiveness.

The traditional reporting approach, often operational, is characterized by annual periodicity or on-demand after crises, focusing on lists of vulnerabilities and attacks. Its target audience is technical teams and IT management, and the nature of the data is reactive, describing what has already happened. Responsibility is assigned solely to the CISO (Chief Information Security Officer). In contrast, evidence-based reporting, aligned with ESG principles and pillar G, is continuous and automated, focusing on control effectiveness and corporate resilience.

For evidence-based reporting, the target audience expands to the Board of Directors, investors, and regulators. The nature of the data is predictive, indicating the probability of future events, and the responsibility is fiduciary and shared with the Board of Directors. This distinction, based on analyses by PwC (2025) and NIST (2024), highlights the need for a more strategic and proactive approach to cybersecurity management, transforming cybersecurity into an integral component of corporate governance.

Cybersecurity Governance Maturity Model: Technical Evolution of Data Processing

The technical evolution of data treatment within the proposed model reflects the maturity of the organization’s analytical infrastructure, increasing processing complexity as levels advance. In Stage 1, named Reactive, log collection is fragmented and occurs manually or passively. Data is stored locally on origin assets, such as servers and terminals, without standardization or centralized indexing, which limits analysis to technical expertise after an incident is confirmed, preventing a proactive view.

In Stage 2, Isolated Controls, organizations have specific security tools that generate basic telemetry in heterogeneous formats such as Syslog, JSON, or XML. Data processing is performed in silos, without a normalization layer that applies a Common Information Model (CIM). Visibility is restricted to specific vendor dashboards, which prevents the necessary triangulation for a holistic view of risk and the identification of broader threat patterns.

Stage 3, KPI Management, consolidates technological integration through SIEM platforms, which centralize and index large volumes of audit log data. Technically, descriptive statistics are used to monitor alert volumes, frequencies, and averages, generating metrics such as Alert Correlation Efficiency (ACE). The focus is on operational efficiency and compliance with remediation SLAs, marking an advance in monitoring capabilities, but still with a predominantly reactive perspective.

In Stage 4, Predictive Governance, data treatment reaches the advanced analytics and data science layer. Machine Learning algorithms, such as Random Forest or XGBoost, are implemented to process the behavior of users and entities (UEBA). The system identifies subtle statistical deviations from behavioral baselines, allowing the detection of weak risk signals with up to 98% accuracy. This predictive capability is fundamental for anticipating threats and acting proactively, transforming risk management.

Finally, in Stage 5, Integration to the Board of Directors, technical data are converted into financial impact metrics through Cyber Risk Quantification (CRQ). Technically, scenario modeling and monetary impact simulations are used to translate technological risk into business language. The evidence flow is automated, ensuring data integrity for ESG reporting and fiduciary decision-making, elevating cybersecurity to the level of rigor of traditional financial audits.

Variability Limits

The adaptability of a predictive framework to different SIEM architectures constitutes one of the main challenges for the standardization of cyber governance. To ensure that the model preserves its predictive accuracy without becoming hostage to a proprietary ecosystem, the strategy must be based on an agnostic and modular approach. The central pillar of this flexibility is the Data Normalization Layer, where raw logs from heterogeneous sources, such as Syslog, JSON, or XML, are transformed into standardized fields following a Common Information Model (CIM).

This standardization allows statistical correlations to operate on normalized identities and behaviors, regardless of whether the original data comes from cloud environments or local infrastructures. Additionally, maintaining accuracy requires the framework to use Agnostic Feature Engineering, focusing on derived behavioral variables, such as statistical time windows, access frequency, and traffic volumes, rather than relying exclusively on vendor-specific technical signatures. The use of agnostic APIs and compatible SIEM architectures allows analytical processing to be decoupled from the storage layer, avoiding technological lock-in and ensuring that changes in network topology do not degrade the model’s prediction power.

To assess the effectiveness of this real-time adaptation, the application of the Log Quality Value (LQV) index is recommended, an agnostic metric that evaluates whether the collected data has the necessary fidelity to support reliable investigations and predictions. By establishing these variability limits, the organization ensures that its risk governance is resilient to technological migrations, maintaining the integrity of the evidence required by ESG reporting, which is fundamental for business credibility and continuity.

GRC-PREDICT Authorial Framework for Cyber Risk Governance

The model proposed in this study, named GRC-PREDICT (Cyber Risk Governance, Predictive Intelligence Framework), organizes the conversion of analytical logs into predictive KPIs through four integrated layers, stemming directly from the triangulation of Bardin’s analysis theoretical cores. The Risk dimension underpins the first layer, the Data Collection layer, focused on compiling critical logs from Level 1 assets to ensure full visibility over databases, domain controllers, systems, and the organization’s most valuable data, guaranteeing collection comprehensiveness.

The Metrics axis structures the second and third layers. The Analytical Processing layer utilizes User and Entity Behavior Analytics (UEBA) and Machine Learning models to create normal behavior baselines and identify subtle statistical deviations. Next, the Performance Indicators layer acts as the core of strategic intelligence, translating these technical signals into understandable metrics to support the Board of Directors in prioritizing risks and allocating budgets, according to the needs of senior management.

The GRC-PREDICT framework proposes a series of KPIs for governance reporting, each with its definition, calculation, and strategic value for the G pillar. The Alert Correlation Efficiency (ACE), defined as the proportion between confirmed alerts and total alerts, assesses the quality of investment in detection. The Problem Recurrence Rate (PRR), which measures the rate of problems that reappear after root cause analysis, indicates the maturity of organizational learning.

The Mean Time to Detect (MTTD), calculated as the average number of days to detect a threat, indicates the level of exposure and the risk of financial impact. Phishing Resilience, expressed by the percentage of users who report versus the percentage of users who click on malicious links, measures the effectiveness of training and the organization’s risk culture. Financial Impact (CRQ – Cyber Risk Quantification), which monetarily quantifies annual risk, translates cyber risk into the language of the Chief Financial Officer (CFO), facilitating the understanding of economic impact.

The Critical Remediation (SLA – Service Level Agreement), which represents the percentage of vulnerabilities corrected within the deadline, demonstrates operational agility in defense. The Third-Party Risk Score, which monitors supplier compliance, is essential for supply chain risk management. Finally, the Regulatory Exposure Index, which indicates the percentage of pending controls regarding regulations such as LGPD and CVM, aims at mitigating regulatory fines and sanctions, ensuring legal compliance and the company’s reputation (ManageEngine, 2025; MetricStream, 2026; Kovrr, 2025).

Finally, the mapping of the Informational Gap guides the fourth layer of the framework, which is the materialization of these metrics into Governance Dashboards. These dashboards should be visually simplified, but technically grounded, relying on Cyber Risk Quantification (CRQ) to allow advisors to visualize the potential for monetary loss and compare cybersecurity investments with other corporate risk categories, such as credit or market. This approach allows for an integrated and strategic view of risks.

Applications of the Framework in Multi-unit Systems and Cooperative Governance

The set of standardized KPIs that make up the GRC-PREDICT framework gains strategic relevance when analyzed from the perspective of decentralized or cooperative corporate systems, such as the supplementary health ecosystem of the Unimed System. In these organizational arrangements, there is a permanent tension between the operational autonomy of singular or local Unimeds and the strategic standardization guidelines issued by central structures or federations. Cyber governance acts as a harmonizing element in this relationship, promoting cohesion and security throughout the system.

By adopting a data-agnostic architecture and a Common Information Model (CIM), the application of this set of KPIs allows each unit to maintain its technical autonomy, while feeding a comparable database among the singular entities. The standardization of metrics such as ACE, CRQ, and Third-Party Risk Score creates a continuous flow of evidence that transforms risk management into a network learning engine, enabling internal benchmarking and the identification of regional gaps. Thus, cyber governance ceases to be perceived as a bureaucratic imposition from headquarters and consolidates itself as a collaborative tool for integrative management and systemic resilience.

Behavioral Change and ESG as a Continuous Process

For the consolidation of pillar G to fulfill its transformative function, it is imperative to recognize that cyber governance and the ESG agenda constitute a continuous and dynamic process, resembling a constantly evolving “movie” rather than a static “photograph” taken in annual audits. The great challenge for organizations lies in promoting a true cultural transformation, overcoming the model where compliance is seen as a mere fulfillment of formal bureaucratic obligations, and encouraging a proactive security culture.

The use of behavioral metrics, such as the Phishing Resilience indicator and UEBA analysis, directs management’s focus to the change in attitude of collaborators and executives. By visualizing in dynamic dashboards the impact of individual actions on corporate risk, the framework stimulates the construction of a preventive and conscious security culture. This continuous engagement prevents the ESG report from degenerating into a purely documentary exercise, ensuring that the commitment to digital integrity permeates the organization’s daily behavior, strengthening overall resilience.

Research Limitations

Although the GRC-PREDICT framework was founded on high-authority regulatory frameworks and updated global reports, this study presents limitations inherent to its design. The absence of empirical quantitative validation in a real corporate environment stands out, which prevents the immediate measurement of the operational accuracy of the proposed KPIs against live cyber threats. This limitation prevents the direct generalization of the results to all operational contexts, requiring future studies for practical validation.

Additionally, the reliance on secondary sources and grey literature, while necessary to capture the 2026 trends, limits the analysis to the institutional perception of regulatory bodies and consultancies. This may not reflect the full extent of the operational nuances of specific technical infrastructures, suggesting the need for future research incorporating primary data and case studies to deepen the understanding of the practical realities and challenges faced by organizations in the day-to-day management of cyber risks.

In summary, the research results evidenced a critical informational gap between the reactive technical fronts and the Board of Directors, which demands a forward-looking vision for effective resource allocation. The transition from a static compliance model to the use of dynamic and behavioral KPIs, as proposed by the GRC-PREDICT framework, substantially strengthens corporate resilience. The integration of these predictive metrics empowers the board for more agile strategic decisions and elevates the transparency and integrity required in reporting the Governance (G) pillar, directly responding to the study’s objective of proposing a model capable of synthesizing security events into strategic intelligence.

4. Conclusion

This study aimed to propose a conceptual model capable of translating technical cybersecurity data into strategic intelligence for senior management, aiming to strengthen corporate governance within the ESG agenda. A critical informational gap was identified between the technical fronts, which operate reactively, and the Board of Directors, which requires a forward-looking view for effective resource allocation and strategic decision-making. The investigation demonstrated that SIEM platforms, despite collecting massive volumes of audit logs, underutilize their predictive potential, being primarily employed for reactive monitoring. It was found that the transition from a static compliance model to the use of dynamic and behavioral Key Performance Indicators (KPIs) substantially strengthens corporate resilience, aligning with increasing regulatory and market demands.

The main contribution of the work lies in the development of the GRC-PREDICT framework, which organizes the conversion of analytical logs into predictive KPIs through integrated layers, enabling senior management to make capital allocation decisions based on probability and monetary risk. This model elevates cybersecurity to the same level of rigor as traditional financial audits, ensuring the transparency and integrity required in reporting the Governance (G) pillar. However, this study presents limitations, such as the absence of empirical quantitative validation in a real corporate environment, which prevents immediate measurement of the operational accuracy of the proposed KPIs and direct generalization of the results. Additionally, the reliance on secondary sources and grey literature, although necessary to capture future trends, limits the analysis to institutional perception, and may not reflect the full operational nuances of specific technical infrastructures. For future developments, it is suggested to empirically apply the model in critical infrastructure sectors and integrate it with Explainable Artificial Intelligence (XAI) systems, aiming to ensure that risk predictions are fully understandable and auditable by regulators and stakeholders, consolidating cyber governance as a minimum requirement for business continuity.

Bibliographic References

Bardin, L. 2016. Análise de Conteúdo. Edições 70, São Paulo, SP, Brasil.

Brasil. 2018. Lei nº 13.709, de 14 de agosto de 2018.

Brasil. 2022. Resolução CVM n° 80, de 29 de março de 2022. Dispõe sobre o Registro e a Prestação de Informações Periódicas e Eventuais dos Emissores de Valores Mobiliários Admitidos à Negociação em Mercados Regulamentados de Valores Mobiliários. Diário Oficial da União, Brasília, 30 mar. 2022.

Brasscom. 2025. Relatório de Cibersegurança 2025: Panorama e Insights. Brasscom, São Paulo, SP, Brasil. Disponível em: https://brasscom.org.br/. Acesso em: 20 abr. 2026.

Committee of Sponsoring Organizations of the Treadway Commission [COSO]. 2017. Enterprise Risk Management: Integrating with Strategy and Performance. 2ed. COSO, New York, NY, EUA.

Creswell, J.W. 2021. Projeto de Pesquisa: Métodos Qualitativo, Quantitativo e Misto. 5ed. Penso, Porto Alegre, RS, Brasil.

Gartner. 2026. Top Cybersecurity Trends for 2026. Gartner, Stamford, CT, EUA. Disponível em: https://www.gartner.com/en/articles/top-cybersecurity-trends-2026. Acesso em: 20 abr. 2026.

Gil, A.C. 2017. Como Elaborar Projetos de Pesquisa. 6ed. Atlas, São Paulo, SP, Brasil.

Information Systems Audit and Control Association [ISACA]. 2018. COBIT 2019 Framework: Introduction and Methodology. ISACA, Schaumburg, IL, EUA.

International Telecommunication Union [ITU]. 2024. Global Cybersecurity Index 2024. ITU, Geneva, Switzerland. Disponível em: https://www.itu.int/epublications/publication/global-cybersecurity-index-2024. Acesso em: 20 abr. 2026.

Lakatos, E.M.; Marconi, M.A. 2021. Fundamentos de Metodologia Científica. 9ed. Atlas, São Paulo, SP, Brasil.

National Institute of Standards and Technology [NIST]. 2024. NIST Cybersecurity Framework 2.0: Enterprise Risk Management Quick-Start Guide. NIST SP 1303. National Institute of Standards and Technology, Gaithersburg, MD, EUA.

PwC. 2025. Resiliência Cibernética: Como Superar os Desafios Diante da Expansão dos Ataques. Pesquisa Global Digital Trust Insights 2025. PwC Brasil, São Paulo, SP, Brasil.

Securities and Exchange Commission [SEC]. 2023. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure. Disponível em: https://www.sec.gov/files/rules/final/2023/33-11216.pdf. Acesso em: 20 abr. 2026.

União Europeia [UE]. 2022. Regulamento (UE) 2022/2554 do Parlamento Europeu e do Conselho, de 14 de dezembro de 2022, relativo a resiliência operacional digital do setor financeiro (DORA). Disponível em: https://eur-lex.europa.eu/legal-content/PT/TXT/?uri=CELEX%3A32022R2554. Acesso em: 20 abr. 2026.

World Economic Forum [WEF]. 2026. Global Cybersecurity Outlook 2026. Disponível em: https://reports.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2026.pdf. Acesso em: 20 abr. 2026.

Article originating from the Final Course Work of the Specialization in Compliance and ESG of the MBA USP/Esalq

To learn more about the course, click here and access the MBX Academy platform