Application of Fuzzy Cognitive Maps for Scenario-Based Modeling of Threat Impacts on Information in Business Processes

Abstract

This paper presents an approach to analyzing the impact of threats and organizational–technical factors on the state of information within business processes using the fuzzy cognitive map methodology. A set of key concepts is defined to represent external and internal threats, vulnerabilities of information systems, protective mechanisms, and the consequences of violations of information confidentiality, integrity, and availability. A formally structured influence matrix is developed, where causal relationships between concepts are described using positive, negative, and neutral interactions, serving as the basis for constructing a cognitive influence graph for a hypothetical business process. The proposed cognitive model enables the identification of systemic interdependencies between risk-generating factors and compensating security controls, allowing a comprehensive assessment of information security resilience. Based on the results of cognitive modeling, scenario analysis is applied to forecast possible trajectories of system behavior under varying threat intensities and levels of protection effectiveness. Several generalized scenarios are considered, including baseline, critical, and optimistic scenarios, which differ in the balance between threats, vulnerabilities, and security measures. The obtained results demonstrate that the level of damage to business processes is largely determined by the coherence and maturity of organizational and technical security mechanisms, as well as their ability to mitigate the negative impact of threats and vulnerabilities. The proposed approach can be adapted to specific enterprises by refining the weights of causal relationships through expert assessments, which enables its practical application as a decision support tool in information security management.