Predictive Cyber Risk Analytics and Computational Risk Metrics for SME Cyber Resilience Using Time-Series Modelling

Small and medium-sized enterprises (SMEs) face increasing cyber threats, while existing cyber resilience approaches remain largely conceptual or provide static assessments with limited predictive capability. This study develops a dynamic mathematical framework for analysing and forecasting cyber resilience in SMEs. Building upon a previously developed conceptual model, the framework formalises the interactions among company security, cyber risk, cybersecurity capability, incident response and recovery, and digital maturity using normalised state variables, bounded nonlinear difference equations, and autoregressive forecasting. The theoretical analysis establishes boundedness of the state variables, equilibrium existence, and local stability of the proposed dynamic system. The framework further integrates computational resilience metrics, a Dynamic Resilience Index (DRI), scenario analysis, and sensitivity analysis within a unified analytical structure. An illustrative simulation demonstrates the computational implementation of the framework by generating resilience trajectories, supporting conditional forecasting, and comparing alternative cybersecurity scenarios. The study concludes that cyber resilience can be represented as a dynamic and measurable organisational capability. The proposed framework provides a transparent and extensible mathematical basis for continuous resilience monitoring, predictive analysis, and evidence-based cybersecurity decision-making in resource-constrained SMEs.