Fuzzy Logic in Cybersecurity: Reducing Vulnerability Queue by 7.5 Times with CVSS, EPSS and FSTEC Comparison
An information security specialist has developed a fuzzy logic system that prioritizes vulnerabilities far more effectively than traditional scoring methods. The approach uses linguistic variables and membership functions to handle the inherent uncertainty in exploitability and impact assessments. By integrating EPSS probability data with CVSS impact scores and vulnerability age, the model reduces the actionable backlog by a factor of 7.5. The implementation relies on the Mamdani inference algorithm and trapezoidal membership functions to produce smooth, human-interpretable urgency ratings. Detailed coverage checks and rule-base validation ensure no gaps exist in the decision space. Real-world testing on CVE-2025-49113 in Roundcube Webmail demonstrated practical advantages over rigid threshold logic. The method is positioned as a practical enhancement rather than a replacement for existing standards.
HabrSep 12, 2026Translated from Russian