CyberRiskOps: The Operating Model for Cyber Resilience in the Age of AI

Why Continuous Cyber Risk Operations Must Become the Operating Model for the Enterprise AI Era

We are entering an era in which cyber risk is no longer shaped only by endpoints, identities, servers, cloud workloads, and data centers. It is now being reshaped by models, inference pipelines, agentic behavior, orchestration layers, MCP connections, real-world integrations, and the invisible trust relationships that bind them together. AI is not just another technology wave to secure. It is a force multiplier for both innovation and risk.

But the deeper shift is not only the expansion of the attack surface. It is the acceleration of everything around it. AI increases the speed of decision-making, the speed of deployment, the speed of integration, the speed of exploitation, and the speed at which business impact can materialize. In this environment, cyber risk no longer behaves like a static condition that can be reviewed periodically. Cyber risk is dynamic, shared, and continuous. It changes as systems change, as trust relationships expand, as identities interact, as models are retrained, as agents are granted autonomy, and as new connections are established between digital systems and real-world outcomes.

In this environment, cyber resilience is no longer a defensive capability. It is achieved through continuous cyber risk management, enabling organizations to operate with confidence despite uncertainty. Resilience now depends on the ability to sense change continuously, interpret risk continuously, prioritize continuously, and reduce exposure continuously. When the environment moves at machine speed, anything less than continuous becomes obsolete the moment it is produced.

That is why I believe organizations need a new operational model, one that goes beyond fragmented security monitoring, static risk registers, annual assessments, vulnerability-centric thinking, and disconnected control reporting. They need CyberRiskOps.

CyberRiskOps is the continuous operationalization of cyber risk. It is the discipline of identifying, contextualizing, prioritizing, mitigating, verifying, and monitoring cyber risk as a living business process, not as a periodic compliance exercise. In the age of AI, this becomes even more important because the attack surface is no longer linear. It is layered, dynamic, interconnected, and increasingly autonomous.

If the traditional enterprise stack created complexity, the enterprise AI stack creates compounding complexity. From data components and training infrastructure to model assets, inference systems, AI agents, MCP, integration points, enterprise systems, and finally observability, governance, and trust, every layer introduces new dependencies, new exposure paths, and new opportunities for attackers to exploit trust, automation, and scale.

And this is precisely why the old language of cyber risk is no longer enough. Heatmaps, spreadsheets, quarterly reviews, static scorecards, and disconnected Excel-based assessments may still create the appearance of governance, but they belong to another world, a slower world, a world where change could be captured after the fact. That world is gone. In an AI-driven enterprise, anything that is not continuous, anything that is not close to real time, anything that cannot evolve with the environment it is trying to measure, is already behind the risk it claims to represent.

Cyber risk today is not a fixed point in time. It is a moving condition. It is shaped by interconnected systems, shared dependencies, third parties, software supply chains, autonomous actions, and invisible trust layers. It is influenced not only by what the organization owns, but by what it connects to, what it consumes, what it automates, and what it allows machines to decide on its behalf. That is why cyber risk must be managed as a continuous operational reality, not as a static reporting exercise.

CyberRiskOps is the model that allows organizations to operate in that reality.

The AI Era Changes the Nature of Cyber Risk

AI does not simply add new tools. It changes how systems behave, how decisions are made, how trust is established, and how damage propagates. A weakness in training infrastructure can poison model behavior. A compromised model asset can create silent downstream errors. A vulnerable inference layer can become an execution point for prompt injection, data leakage, or abuse. A poorly governed agent can take insecure actions at machine speed. An exposed integration point can turn a low-friction connection into a high-consequence compromise. A weak observability and governance layer can leave the organization blind precisely when visibility matters most.

This is why AI security cannot be treated as a side conversation within the security team. It must be integrated into continuous cyber risk operations. The enterprise does not need isolated AI security controls alone. It needs a continuous mechanism to understand which AI-related risks matter most, why they matter, what business context amplifies them, and how to reduce them in a measurable way.

The core challenge is speed. In the past, organizations could tolerate delays between exposure, discovery, analysis, and action. In the age of AI, those delays become structural weaknesses. When systems learn faster, connect faster, and act faster, risk also accumulates faster. An ungoverned connector, an overprivileged agent, or a model with weak trust boundaries can create business impact before a traditional governance process even updates the slide deck. That is the essence of CyberRiskOps.

CyberRiskOps as a Continuous Operating Model

At the heart of CyberRiskOps is the idea that cyber risk should move in a continuous loop. It is not enough to identify problems. The organization must also understand the business meaning of those problems, prioritize what matters most, reduce risk deliberately, verify whether actions worked, and monitor for change. This is especially true in AI environments, where models evolve, integrations expand, prompts change, agents learn new workflows, and exposure can increase faster than traditional governance cycles can respond.

In this model, Continuous Cyber Risk Assessment and Continuous Cyber Risk Reduction are not isolated programs. They are two gears in the same machine, connected through what I describe as CyberRiskOps. Around them sits the broader operating environment, where Cyber Risk Exposure Management, continuous scoring and quantification, and a Cyber Risk Operations Center bring visibility, coordination, and decision-making discipline.

The key word is not assessment. The key word is not reduction. The key word is continuous. Continuous means the organization is no longer relying on snapshots to represent moving risk. Continuous means telemetry, business context, exposure intelligence, and validation are flowing into an operating model that can adapt as the environment changes. Continuous means the organization is no longer describing yesterday’s risk while being attacked by today’s conditions.

Below is how I see each stage of CyberRiskOps in the age of AI.

1. Cyber Risk Identification

Everything starts with identification, but identification in the AI era must go far beyond asset inventory. Organizations must identify not only devices, workloads, identities, and software, but also datasets, training pipelines, models, vector stores, inference endpoints, orchestration frameworks, agents, connectors, APIs, plugins, MCP bridges, and downstream real-world actions.

The challenge is that many organizations still see AI as an application feature rather than as a new risk domain. They know where their laptops are. They know where many of their servers are. But they often do not know where their model artifacts live, which agents are connected to sensitive systems, what external models are being invoked, which datasets trained a system, or where trust boundaries are being crossed.

In CyberRiskOps, identification means discovering the full exposure graph of the enterprise AI stack. It means understanding where data enters, where models are built, where inference occurs, where agents make decisions, where integrations reach into enterprise systems, and where governance should exist but often does not. Identification is not a static inventory. It is continuous exposure discovery.

In practical terms, this means that the organization must identify technical exposure, operational exposure, and business exposure at the same time. A prompt injection path is not just a technical flaw. It may be a pathway into confidential data, customer harm, fraud, regulatory failure, or reputational damage. CyberRiskOps begins by making those paths visible.

And because risk is shared, identification must also extend beyond organizational boundaries. Third-party AI services, external APIs, open-source components, managed platforms, partner ecosystems, and software supply chains are all part of the risk picture. If the organization only identifies what it owns, it will miss what can hurt it.

2. Contextualization

Risk without context is just noise. This has always been true, but AI makes the problem much worse. The same vulnerability, misconfiguration, or exposed integration can have radically different consequences depending on where it exists in the AI stack and what it touches in the business.

A model artifact stored in an isolated test environment is not the same as a model serving underwriting decisions, fraud scoring, medical workflows, customer support, or autonomous actions in production. An API key exposed in a sandbox is not the same as an MCP connector with permissions into ERP, CRM, identity systems, cloud control planes, or payment workflows.

Contextualization is the stage where CyberRiskOps asks the questions that separate technical findings from decision-grade intelligence. What business process does this AI component support. What data does it handle. What systems can it influence. What trust assumptions does it rely on. What is the blast radius if it fails, is abused, or is manipulated. Is the issue exploitable by an external attacker, an insider, a third-party dependency, or an agentic chain of actions.

This is also where the AI stack becomes essential. Data components carry data integrity and provenance risk. Training infrastructure carries poisoning and model manipulation risk. Model assets carry theft, tampering, and substitution risk. Inference systems carry abuse and leakage risk. AI agents carry delegated action risk. MCP and integration points carry trust expansion risk. Enterprise systems and real-world state carry business consequence risk. Observability, governance, and trust determine whether the organization can even detect or control what is happening.

Context is what turns exposure into priority. Without context, the organization sees thousands of signals. With context, it sees which ones can materially affect resilience, growth, trust, and business continuity.

Contextualization transforms findings into meaning. It is how the organization stops asking, “What is vulnerable?” and starts asking, “What could truly hurt us, and why?”

3. Prioritization

In most organizations, prioritization is where good intentions go to die. Security teams drown in alerts, vulnerability counts, control gaps, model concerns, and competing operational demands. AI multiplies this problem because it introduces a new class of risks that are often poorly understood, difficult to compare, and even harder to rank against traditional exposures.

CyberRiskOps solves this by making prioritization a continuous risk decision process rather than a patching queue. The objective is not to fix everything. The objective is to reduce the risks that matter most to the business, the fastest, with the greatest measurable impact.

That requires combining technical severity with exploitability, business criticality, data sensitivity, exposure pathways, dependency concentration, operational importance, and likely downstream impact. In the AI era, it also requires understanding which layer of the AI stack is affected and whether the issue can propagate upward or outward. A weakness in observability and governance can undermine confidence across the entire stack. A weakness in integration points can turn one compromised interface into a multi-system incident. A weakness in an agent can create action at machine speed, with little human friction to slow it down.

Prioritization is where continuous cyber risk scoring and quantification become indispensable. The organization needs a way to compare unlike risks in a common operational language. It needs to understand not only severity, but consequence. Not only urgency, but business relevance. Not only exposure, but expected impact.

This is where heatmaps fail. They compress living, moving, interconnected risk into a static visual that often lacks timing, dependency, exploitation probability, and business consequence. A heatmap may describe categories. It rarely describes operational reality. The same is true for spreadsheet-based risk tracking. By the time the rows are updated, the environment has already changed.

In this sense, prioritization is the bridge between cybersecurity and executive decision-making. It is how cyber risk becomes intelligible to the business.

4. Mitigation

Mitigation is often misunderstood as remediation alone. In CyberRiskOps, mitigation is broader. It includes reducing exposure, reducing likelihood, reducing impact, and reducing uncertainty. Sometimes that means patching. Sometimes it means reconfiguring. Sometimes it means adding guardrails, changing permissions, isolating a model, enforcing stronger provenance controls, limiting agent autonomy, inserting approval steps, hardening integrations, or redesigning workflows so trust is not assumed where it should be verified.

This is especially important in AI environments, because many AI risks are not solved by a single software update. Prompt injection is not just a patching issue. Model misuse is not just a patching issue. Over-privileged agents are not just a patching issue. Weak data lineage is not just a patching issue. These are operational and architectural risks that must be reduced intentionally.

At the different layers of the AI stack, mitigation looks different. At the data layer, it may mean stronger provenance, classification, and integrity controls. At the training layer, it may mean isolated pipelines, secure dependencies, and controlled access. At the model layer, it may mean signing, version control, drift validation, and access restrictions. At the inference layer, it may mean runtime protections, filtering, abuse controls, and output monitoring. At the agent layer, it may mean constrained actions, scoped permissions, and human approval for high-risk workflows. At the integration layer, it may mean zero trust enforcement, transaction validation, and strict connector governance. At the trust layer, it may mean transparency, auditability, and measurable accountability.

Mitigation in CyberRiskOps is not about activity. It is about reduction. If the organization cannot demonstrate reduced exposure, reduced consequence, or reduced uncertainty, then it has not truly mitigated risk.

And because the environment keeps changing, mitigation cannot be treated as a closed ticket. Mitigation must be continuous adaptation. New models, new connectors, new prompts, new autonomous actions, and new business processes will keep reintroducing risk. The organization must therefore reduce risk in a way that evolves with the system, not in a way that assumes the system will remain still.

5. Verification

One of the most overlooked stages in cybersecurity is verification. Teams often assume that once an issue is fixed, the risk is reduced. But in reality, many controls are partially deployed, inconsistently applied, bypassed by architecture, broken by change, or ineffective against the actual adversary path.

In the age of AI, verification becomes even more important because systems are adaptive, layered, and behavior-driven. A mitigation that looks correct on paper may fail in practice. A guardrail may be easy to bypass. A model control may create a false sense of safety. A secure integration may still expose unintended action chains when an agent behaves differently than expected. Verification means testing whether the mitigation actually changed the risk posture. Did the exposure path close. Did permissions shrink. Did model behavior improve. Did governance become enforceable. Did monitoring gain the visibility it lacked. Did the business actually become more resilient. This is where validation becomes essential. Verification is not just about checking whether a control exists. It is about validating whether that control works under realistic conditions, against realistic adversary behavior, and across the interconnected layers of the environment. In other words, verification is where organizations move from assumption to evidence.

This is also where the concept of digital twins becomes powerful. A digital twin allows the organization to simulate threats, attack paths, adversary behavior, and control effectiveness in a safe environment without creating real-world impact. It gives security teams a way to test exposures, validate exploitability, and understand how risk propagates across systems before attackers do. In the context of CyberRiskOps, digital twins help transform verification from a static review exercise into a dynamic validation capability.

Using digital twins, organizations can perform adversarial exposure validation in a far more continuous and intelligent way. They can simulate virtual red teaming to uncover exposures before adversaries exploit them. They can validate whether known exposures are actually exploitable in their environment. They can run breach and attack simulations continuously to test whether security controls still work as intended as the environment changes. This is especially important in AI-enabled systems, where behaviors, dependencies, and trust relationships can evolve faster than traditional validation methods can keep up. Verification is therefore not only about technical testing. It is about proving resilience through evidence. Purple teaming, exposure validation, control testing, runtime assessment, adversarial simulation, and outcome-based measurement all play a role here. Verification is how CyberRiskOps avoids theater. It is the moment where the organization proves that reduction is real.

For AI systems, verification should include not only technical validation but also behavioral validation. It is not enough to ask whether the system is patched. We must ask whether the system acts safely, predictably, and within governed boundaries under realistic conditions. We must ask whether an AI agent can be manipulated into unsafe action, whether a model can be influenced in ways that bypass intended controls, whether an integration can be abused through chained trust, and whether governance holds when the system is under pressure.

What cannot be validated continuously cannot be trusted operationally. In the age of AI, verification must evolve from periodic control review to continuous adversarial validation, powered by digital twins, simulation, and evidence-driven testing of how risk actually behaves in the real environment.

6. Monitoring

Monitoring closes the loop, but it also restarts it. Cyber risk is dynamic, and AI accelerates that dynamism. New models are introduced, prompts evolve, connectors are added, permissions drift, agents gain new tasks, dependencies change, and business priorities shift. What was low risk yesterday may become critical tomorrow because the surrounding context changed.

Monitoring in CyberRiskOps is not passive logging. It is continuous awareness of changing exposure, changing business context, and changing control effectiveness. It means tracking not only security events, but also risk signals across the AI stack. Data anomalies, model drift, unusual inference behavior, unauthorized integrations, agent action deviations, permission expansion, abnormal connector activity, governance violations, and trust degradation should all be part of the monitoring fabric.

This is where the idea of a Cyber Risk Operations Center, a CROC, becomes powerful. Traditional SOCs monitor events. A CROC monitors risk. It brings together telemetry, exposure intelligence, business context, scoring, and operational decisions into one continuous cycle. In the AI era, that shift matters because the organization cannot afford to look only for indicators of compromise. It must also look for indicators of elevated risk before compromise occurs.

Monitoring is the proof that CyberRiskOps is alive. If risk cannot be observed continuously, it cannot be operated continuously. And if it cannot be operated continuously, then the organization is falling back into the old world of snapshots, summaries, and delayed awareness.

Monitoring is how CyberRiskOps stays alive. It ensures that risk operations remain continuous, adaptive, and decision-oriented.

7. Continuous Cyber Risk Assessment and Continuous Cyber Risk Reduction

The framework places Continuous Cyber Risk Assessment and Continuous Cyber Risk Reduction at the center, connected by CyberRiskOps. I believe this is one of the most important ideas for modern cybersecurity leadership. Assessment without reduction becomes reporting. Reduction without assessment becomes guesswork.

In AI-driven enterprises, this relationship becomes even more critical. Assessment must continuously map how the AI stack is evolving, where exposure is increasing, and what business processes are being affected. Reduction must continuously translate that intelligence into action, architectural change, governance enforcement, control tuning, and business protection. This is not an annual exercise. It is not a quarterly review. It is not a one-time AI security initiative. It is an operating model.

And it is an operating model because cyber risk itself is now operating continuously. It flows across infrastructures, identities, applications, cloud services, AI layers, third parties, and machine decisions. It is shared across owners, shared across dependencies, and shared across digital ecosystems. A static report cannot capture that. A delayed review cannot govern that. A manually updated spreadsheet cannot control that.

Anything that is not continuous belongs to another era of cybersecurity. Static heatmaps, manually updated Excel files, quarterly risk reviews, and snapshot-based governance models were built for a world that moved slower than today’s threat landscape. In the age of AI, where change happens continuously and adversaries operate at machine speed, cyber risk must be observed, interpreted, and acted on continuously as well. Otherwise, what leaders are seeing is not current risk, but historical residue.

8. The Role of CREM, CRI, CRQ, and CROC

CyberRiskOps does not operate in isolation. It is strengthened by a broader ecosystem of capabilities:

Cyber Risk Exposure Management, or CREM, gives the organization the ability to continuously understand exposure across the environment. In the AI era, CREM must expand beyond classic asset exposure to include model exposure, agentic exposure, trust exposure, and integration exposure.

Cyber Risk Index, or CRI, provides the continuous scoring layer. It gives leaders a way to score cyber risk in a more operational, dynamic, and decision-oriented manner, allowing them to compare risks, track changes over time, and understand where exposure is increasing or decreasing. In this sense, CRI helps transform cyber risk from fragmented technical observations into a more intelligible operational signal.

Cyber Risk Quantification, or CRQ, provides the quantification layer. It helps leaders translate cyber risk into economic and business terms, making it possible to understand not only that a risk exists, but what it could mean in terms of business disruption, financial impact, resilience loss, or strategic consequence. This is how cybersecurity begins to speak the language of the board, the CFO, and the business.

Cyber Risk Operations Center, or CROC, provides the operational nerve center. It is the place where risk is continuously observed, analyzed, prioritized, and acted upon. In many ways, CROC is what a mature organization needs when a SOC alone is no longer sufficient. Because in the age of AI, the problem is not simply detecting attacks. The problem is continuously operating cyber risk across a living, adaptive, machine-speed environment.

Together, these capabilities move the organization away from retrospective governance and toward real operational resilience. CREM makes exposure visible. CRI makes risk scoreable. CRQ makes risk quantifiable. CROC makes response continuous. CyberRiskOps makes all of it operational.

Mapping CyberRiskOps to the 9 Layers of the Enterprise AI Stack

The 9-layer AI stack is useful because it reminds us that AI risk is not concentrated in one place. It is distributed. At the lower layers, the organization must secure the foundations, data, training infrastructure, and model assets. In the middle layers, it must govern inference systems, AI agents, and orchestration mechanisms like MCP. At the upper layers, it must protect integration points, enterprise systems, and the real-world state that AI can influence. Above all of them sits observability, governance, and trust, not as an optional wrapper, but as the condition for safe operation.

CyberRiskOps gives the organization a way to operate across all nine layers continuously. Identification discovers the layers and their relationships. Contextualization interprets their business meaning. Prioritization determines what matters most. Mitigation reduces exposure deliberately. Verification proves whether risk actually fell. Monitoring ensures that the picture stays current as the stack evolves. This is how AI security becomes operational. This is how cyber risk becomes governable.

And this is why the AI stack matters so much. It shows that cyber risk is no longer confined to traditional infrastructure boundaries. It lives in data lineage, in model behavior, in inference exposure, in agent autonomy, in protocol trust, in enterprise integrations, and in the real-world actions those systems can trigger. When risk is distributed across the stack, operations must be continuous across the stack as well.

Why This Matters to the Board and the C-Suite

Boards and executives do not need more dashboards filled with disconnected security data. They need confidence that the organization can make informed decisions under uncertainty, especially as AI becomes embedded into operations, products, customer experience, and strategic differentiation. CyberRiskOps provides that confidence because it creates a repeatable mechanism for turning technical complexity into business clarity. It helps leadership understand where AI introduces opportunity, where it introduces fragility, and where risk reduction should be funded first. It makes cybersecurity more than defense. It makes it an enabler of safer innovation.

In a world of autonomous systems, machine-speed actions, and expanding digital trust dependencies, resilience will not come from reacting faster alone. It will come from operating risk better.

And operating risk better means abandoning the comforting but outdated artifacts of a slower era. Board-level cyber conversations cannot rely only on red-yellow-green summaries, quarterly committee slides, and backward-looking maturity charts. Those tools may still have a place for communication, but they cannot be the operating system of resilience. Leadership needs living risk intelligence, not static representations of a past state.

Continuous Cyber Risk Management Is the New Foundation of Cyber Resilience

The age of AI is forcing cybersecurity to evolve beyond static protection models, fragmented programs, and retrospective reporting. The environment is moving too fast, the dependencies are too interconnected, and the consequences are too immediate for cyber risk to be managed through periodic reviews, isolated controls, or governance artifacts built for a slower world. Cyber resilience is no longer built through defensive posture alone. It is built through continuous cyber risk management. That is the shift. Resilience now depends on the ability to identify change as it happens, interpret risk in context, prioritize what matters most, validate whether controls truly work, and continuously adapt as the environment evolves.

This is why CyberRiskOps matters. It provides the operating model to manage cyber risk as a living, dynamic, and shared reality across the enterprise. It recognizes that in the age of AI, risk is no longer fixed, isolated, or periodic. It is continuous. It flows across models, agents, integrations, identities, cloud platforms, third parties, and real-world business processes.

Anything that is not continuous is falling behind the risk it is trying to represent. Static heatmaps, manually updated spreadsheets, quarterly reviews, and snapshot-based reporting may still describe parts of the past, but they cannot govern the speed of the present. In an AI-driven enterprise, leadership needs living risk intelligence, not delayed representations of a reality that has already changed. The organizations that will lead in this new era will not be the ones that simply detect more threats. They will be the ones that can continuously operate cyber risk, continuously validate resilience, and continuously make better decisions under uncertainty.

Continuous cyber risk management is no longer an aspiration. It is the new foundation of cyber resilience.

Castro, J. (2025). Cyber RiskOps: Bridging Strategy and Operations in Cybersecurity. ResearchGate. **https://www.researchgate.net/publication/388194428 DOI:[10.13140/RG.2.2.36216.97282/1](http://dx.doi.org/10.13140/RG.2.2.36216.97282/1)**

Castro, J. (2024). Integrating Cyber Risk Management to your Cybersecurity Strategy: Operationalizing with SOC & CROC. ResearchGate. **https://www.researchgate.net/publication/388493453 DOI:[10.13140/RG.2.2.30164.72328/1](http://dx.doi.org/10.13140/RG.2.2.30164.72328/1)**

Castro, J. (2025). What Is Strategy in Cybersecurity? Rethinking the Way We Lead, Protect and Adapt. ResearchGate. **https://www.researchgate.net/publication/393674625 DOI:[10.13140/RG.2.2.16703.42409](http://dx.doi.org/10.13140/RG.2.2.16703.42409)**

Castro, J. (2025). Defining Cyber Risk, Cyber Risk Scoring, and Cyber Risk Quantification. ResearchGate. **https://www.researchgate.net/publication/396206049 DOI:[10.13140/RG.2.2.21760.90885](https://doi.org/10.13140/RG.2.2.21760.90885)**

Castro, J. (2024). The Importance of the Cyber Risk Operations Center (CROC) in Risk Based Threat Detection. ResearchGate. **https://www.researchgate.net/publication/388117513 DOI:[10.13140/RG.2.2.32673.11364/1](https://doi.org/10.13140/RG.2.2.32673.11364/1)**

Castro, J. (2025). Every Cyber Risk. Every Signal. Continuous Defense Loop. ResearchGate. **https://www.researchgate.net/publication/396885730 DOI:[10.13140/RG.2.2.30137.22882/1](https://doi.org/10.13140/RG.2.2.30137.22882/1)**

Castro, J. (2025). Cybersecurity Paralysis When the Cyber Brain of the Organization Breaks. ResearchGate. **https://www.researchgate.net/publication/397927310 DOI:[10.13140/RG.2.2.25955.00802/1](https://doi.org/10.13140/RG.2.2.25955.00802/1)**

Castro, J. (2025). Artificial Intelligence (AI) vs Artificial Instinct (Ai), The Distinction Cybersecurity Can’t Afford to Ignore. ResearchGate. **https://www.researchgate.net/publication/397834714 DOI:[10.13140/RG.2.2.31096.30725](https://doi.org/10.13140/RG.2.2.31096.30725)**

Castro, J. (2026). The 9 Layers of the Enterprise AI Stack: Understanding How Intelligence Is Created, How It Operates, and Where the New Attack Surface Emerges. ResearchGate. **https://www.researchgate.net/publication/400970214 DOI:[10.13140/RG.2.2.28561.29283](https://doi.org/10.13140/RG.2.2.28561.29283)**