Security Operations Centers (SOCs) face a persistent overload problem: thousands of heterogeneous alerts per day, each characterized by severity, exploitability, asset criticality, regulatory exposure, and threat intelligence signals. Existing prioritization approaches—CVSS-only scoring, vendor-proprietary models, and machine-learning classifiers—either collapse this multi-dimensional risk into a single number, lack transparency, or require labeled training data that is scarce in operational environments. We present AEGIS (Adversarial-Aware Evaluation for Guided Incident Scoring), a deterministic Multi-Criteria Decision Analysis (MCDA) method that extends TOPSIS with three domain-specific modifications: Temporal Decay Boosting (TDB), which dynamically amplifies scores for aging vulnerabilities based on each alternative's age; Cascading Risk Propagation (CRP), which models systemic risk amplification through asset dependency graphs; and Adversarial Asymmetric Distance (AAD), which applies disproportionate penalty for underestimating critical threats. We prove that classical TOPSIS is a special case of AEGIS (when α=0, γ=0, φ=1), derive boundedness and convergence properties for each extension, establish a weight sensitivity bound quantifying ranking stability under parameter uncertainty, and characterize necessary conditions for rank discordance between AEGIS and standard TOPSIS. We further prove that AEGIS inherits TOPSIS's rank reversal susceptibility and identify a non-trivial negative result: CRP can violate criterion monotonicity under specific graph topologies. A Monte Carlo experiment on 10,000 synthetic 10×7 matrices quantifies the divergence: CRP is the primary divergence driver (Kendall τ drops from 0.990 to 0.184 as γ increases from 0 to 0.7), rank reversal occurs in 100% of trials, and CRP monotonicity violation manifests in 41.5% of scenarios. An empirical evaluation on 1,000 real CVEs from NVD (2021–2023) with CISA KEV ground truth (120 KEV, 12% base rate) yields AEGIS AUC-ROC of 0.848—the highest among the MCDA methods tested (TOPSIS 0.826, VIKOR 0.770, PROMETHEE 0.767, CVSS-only 0.702). The ablation study identifies CRP as the sole positive contributor to the +2.6 pp improvement over base TOPSIS. Robustness analysis shows ranking stability under weight perturbation (100 trials, max |ΔAUC| = 0.017). Code and cached data are provided to support reproducibility.
Anderson Acosta de Paiva (Wed,) studied this question.