Original Development of a Vulnerability Prioritisation Model for Critical National Infrastructure in Nigeria Using Threat Intelligence and Risk Quantification Methods

Nigeria's critical national infrastructure, encompassing the electricity grid, oil and gas pipelines, telecommunications backbone, and financial clearance systems, is exposed to cyber threats whose prioritisation for defensive investment requires an original quantitative risk model tailored to Nigeria's specific threat landscape and resource constraints. This study develops an original vulnerability prioritisation model for Nigerian critical national infrastructure drawing on national threat intelligence data and adapted risk quantification methods. The model development involved three original methodological contributions: a national CNI threat intelligence synthesis from CERT-NG incident reports, EFCC cybercrime statistics, and NCC network security reports aggregated across 2019 to 2023; a sector-specific attack tree formalism calibrated to Nigerian CNI architectural characteristics using expert elicitation with 25 CNI security professionals; and a multi-criteria vulnerability prioritisation algorithm combining Common Vulnerability Scoring System base scores with Nigeria-specific exploitability multipliers derived from the threat intelligence analysis. The model was applied to a vulnerability dataset of 1,240 published CVEs affecting systems deployed across five CNI sectors and validated through expert panel agreement analysis. Available CNI cybersecurity literature from developing country contexts identifies the mismatch between globally standardised CVSS scores and locally relevant exploitability conditions as the primary limitation of imported vulnerability management frameworks. The Risk Quantification Theory and the National Cyber Risk Assessment Framework of ENISA provide the theoretical basis. The original model demonstrates superior expert agreement compared to CVSS-only prioritisation. Keywords: vulnerability prioritisation, critical national infrastructure, Nigeria, threat intelligence, risk quantification.