A multi-stage composite fuzzy and neuro-adaptive framework for robust cybersecurity risk quantification in critical infrastructure

As Information Technology (IT) and Operational Technology (OT) networks converge within critical infrastructure, cybersecurity risk must be quantified under uncertainty and incomplete observability, conditions under which conventional, static scoring methods perform poorly. This paper presents the Multi-Stage Composite Fuzzy and Neuro-Adaptive (MCFNA) framework for quantifying operational cyber-risk in Industrial Control System (ICS) environments. MCFNA composes three interpretable Mamdani fuzzy inference stages that resolve, in turn, threat capability, attack likelihood, and overall operational risk, and augments them with an Adaptive Neuro-Fuzzy Inference System (ANFIS) layer that calibrates the fuzzy model to observed telemetry. The coupled learning procedure is proven to converge to a first-order stationary point. The framework is evaluated on the Secure Water Treatment (SWaT) benchmark under a leakage-controlled feature pipeline and an attack-scenario-wise train/test split that prevents dependent time windows from crossing the split boundary. Across regression and classification measures, the adaptive framework improves risk-estimation accuracy over linear-regression, neural-network, and ensemble baselines, and a sensitivity analysis identifies asset vulnerability as the dominant risk driver. These results indicate that MCFNA can provide interpretable, numerically stable, and actionable risk estimates to help prioritise Security Operations Center remediation in converged IT/OT infrastructure.