@prefix cyber: <https://semanticdataservices.com/ontology/domain/cybersecurity#> .
@prefix port: <https://semanticdataservices.com/ontology/domain/portfolio#> .
@prefix risk: <https://semanticdataservices.com/ontology/domain/risk#> .
@prefix sdsu: <https://semanticdataservices.com/ontology/core/upper#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix dct: <http://purl.org/dc/terms/> .

<https://semanticdataservices.com/ontology/domain/cybersecurity> a owl:Ontology ;
  owl:versionIRI <https://semanticdataservices.com/ontology/2026.08/domain/cybersecurity> ; owl:versionInfo "2026.08" ;
  owl:imports <https://semanticdataservices.com/ontology/core/upper>, <https://semanticdataservices.com/ontology/domain/risk> ;
  dct:title "SDS Cybersecurity Ontology"@en ; dct:creator "Semantic Data Services" .

cyber:CyberAsset a owl:Class ; rdfs:subClassOf sdsu:System ; rdfs:label "Cyber asset"@en .
cyber:Identity a owl:Class ; rdfs:subClassOf sdsu:Agent ; rdfs:label "Digital identity"@en .
cyber:Vulnerability a owl:Class ; rdfs:subClassOf sdsu:Entity ; rdfs:label "Vulnerability"@en .
cyber:ThreatActor a owl:Class ; rdfs:subClassOf sdsu:Agent ; rdfs:label "Threat actor"@en .
cyber:AttackTechnique a owl:Class ; rdfs:subClassOf sdsu:Entity ; rdfs:label "Attack technique"@en .
cyber:SecurityIncident a owl:Class ; rdfs:subClassOf sdsu:Event ; rdfs:label "Security incident"@en .
cyber:SecurityControl a owl:Class ; rdfs:subClassOf sdsu:Control ; rdfs:label "Security control"@en .
cyber:ThreatIntelligenceReport a owl:Class ; rdfs:subClassOf sdsu:Evidence ; rdfs:label "Threat intelligence report"@en .

cyber:targetsAsset a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range cyber:CyberAsset ; rdfs:label "targets asset"@en .
cyber:usesTechnique a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range cyber:AttackTechnique ; rdfs:label "uses technique"@en .
cyber:exploits a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range cyber:Vulnerability ; rdfs:label "exploits"@en .
cyber:attributedTo a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range cyber:ThreatActor ; rdfs:label "attributed to"@en .
cyber:mitigatedBy a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range cyber:SecurityControl ; rdfs:label "mitigated by"@en .
cyber:createsRisk a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range risk:CyberRisk ; rdfs:label "creates risk"@en .
cyber:mayImpactPortfolio a owl:ObjectProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range port:Portfolio ; rdfs:label "may impact portfolio"@en .
cyber:hostsDataProduct a owl:ObjectProperty ; rdfs:domain cyber:CyberAsset ; rdfs:range sdsu:DataProduct ; rdfs:label "hosts data product"@en .
cyber:attackTechniqueId a owl:DatatypeProperty ; rdfs:domain cyber:AttackTechnique ; rdfs:range xsd:string ; rdfs:label "attack technique identifier"@en .
cyber:vulnerabilityId a owl:DatatypeProperty ; rdfs:domain cyber:Vulnerability ; rdfs:range xsd:string ; rdfs:label "vulnerability identifier"@en .
cyber:severity a owl:DatatypeProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range xsd:string ; rdfs:label "severity"@en .
cyber:incidentStatus a owl:DatatypeProperty ; rdfs:domain cyber:SecurityIncident ; rdfs:range xsd:string ; rdfs:label "incident status"@en .