<![CDATA[Penelitian ini mengembangkan kerangka GenAI-Enhanced Cyber Risk Assessment untuk website perguruan tinggi dengan mengintegrasikan pembangkitan skenario serangan sintetis, validasi berbasis bukti, pemodelan attack graph, serta kuantifikasi risiko menggunakan CVSS, EPSS, dan centrality. Penelitian menggunakan Design Science Research dengan pendekatan mixed methods. Pipeline yang dikembangkan terdiri atas Generator Agent, Evaluator Agent, dan Reasoning Agent. Pada dataset penelitian, sebanyak 1.284 skenario unik dihasilkan setelah penyaringan format, pemeriksaan bukti, dan deduplikasi. Sebanyak 146 skenario dipilih untuk limited security validation; jumlah skenario yang memenuhi seluruh kriteria validasi empiris dilaporkan secara terpisah. Perhitungan skor risiko dilakukan secara deterministik menggunakan kombinasi CVSS normalized, EPSS, dan centrality dengan bobot 0,50, 0,30, dan 0,20. Analisis ekonomi berbasis skenario menunjukkan estimasi incremental ROI sebesar 117,5% dan benefit–cost ratio sebesar 2,18:1 pada asumsi baseline ALE Rp700.000.000, reduksi ALE 18%, dan biaya tambahan GenAI Rp57.920.000 per tahun. Nilai ekonomi tersebut merupakan estimasi sensitivitas, bukan return aktual, karena belum didasarkan pada data insiden dan biaya operasional longitudinal. Hasil penelitian menunjukkan potensi penggunaan GenAI untuk mempercepat penyusunan dan prioritisasi skenario risiko, tetapi generalisasi masih dibatasi oleh jumlah website, ketergantungan pada data sintetis, dan cakupan validasi keamanan yang terbatas. This study develops a GenAI-Enhanced Cyber Risk Assessment framework for university websites by integrating the generation of synthetic attack scenarios, evidence-based validation, attack graph modeling, and risk quantification using CVSS, EPSS, and centrality. The study employs Design Science Research with a mixed-methods approach. The developed pipeline consists of a Generator Agent, an Evaluator Agent, and a Reasoning Agent. In the research dataset, a total of 1,284 unique scenarios were generated after format filtering, evidence checking, and deduplication. A total of 146 scenarios were selected for limited security validation; the number of scenarios meeting all empirical validation criteria is reported separately. Risk scores were calculated deterministically using a combination of normalized CVSS, EPSS, and centrality, weighted at 0.50, 0.30, and 0.20, respectively. Scenario-based economic analysis shows an estimated incremental ROI of 117.5% and a benefit–cost ratio of 2.18:1, assuming a baseline ALE of Rp700,000,000, an ALE reduction of 18%, and additional GenAI costs of Rp57,920,000 per year. These economic values are sensitivity estimates, not actual returns, as they are not yet based on longitudinal incident data and operational costs. The study results indicate the potential for using GenAI to accelerate the development and prioritization of risk scenarios; however, generalizability remains limited by the number of websites, reliance on synthetic data, and limited security validation coverage.]]>
