Cyber security challenges for software vendors through a fuzzy-TOPSIS approach

Previous articles analyzing cybersecurity challenges

Cybersecurity has become an essential part of computer systems, which indicates its increasing importance (Cabaj et al., 2018). In the digital world, the term cybercrime includes illegal activities involving the transmission of mathematical, symbolic or other information across local and international networks. These activities may include persons, objects, events, phenomena, or practices (Khan et al., 2022c). The new approach includes the adoption of new cyber risk insurance policies that provide compensation for damages caused by cyber-security breaches (Gordon, Loeb & Sohail, 2003). Denial of service (DoS) attacks often result in resource depletion, a continuously expanding category. To remedy this, one effective preventive strategy is to set a buffer size limit and consistently verify it whenever the buffer is used (Schneidewind, 2009). The financial impact of such cyberattacks is substantial, running into millions of pounds, euros, or dollars, posing a significant threat to individuals and enterprises alike (Mouheb, Abbas & Merabti, 2019).

Various cyber-attacks target the network layer, focusing on denial of service and malicious cloud computing (Acal et al., 2015). Spoofing is a common low-cost and high-return attack that entices consumers to disclose personal information via fraudulent websites that closely resemble legitimate websites (Chinese Academy of Cyberspace Studies, 2019). For businesses heavily dependent on information technology (IT), the cost of a cyber-attack may rival the cost of a decrease in sales to retailers (Campbell et al., 2003). In U2Su (user-to-root) attacks, the intruder first gains access to the default user account on the target system before exploiting a weakness to gain root privileges (Abraham, Grosan & Chen, 2005). According to Cerrudo (2015), Sensys Networks equipment lacked encryption, authorization and protection, which allowed the attackers to manipulate the traffic management system and to manipulate the traffic lights, meters and signals. Once the encryption key is compromised, the hackers have full access to the message.

Given the significant impact of cybercrime on the economy and on the security of companies and countries, it has become an urgent issue (Cabaj et al., 2018). Identifying and assessing the direct and indirect costs of security breaches is a complex task that is recognized by researchers and managers alike (Pfleeger & Rue, 2008). Vulnerability investigators often prioritize financial gain and reputation when disclosing their findings (Li & Liao, 2016). The cost of cyber-attacks, including hacking, ransomware, and spam, increased from USD 1 billion in 1996 to USD 56 billion in 2004 (Schneidewind, 2009). Outbreaks of malware targeting online banking services cost US banks $120 million, underlining the financial consequences of insufficient cyber security (Moore, 2010). As organizations store more and more sensitive and valuable data, the consequences of underinvestment in cybersecurity resources are becoming increasingly serious (Rue, Pfleeger & Ortiz, 2007).

The importance of cybersecurity has grown to the extent that it is now recognized as a distinct discipline (Cabaj et al., 2018). Extensive projects have been started in the systems and networking areas to develop capabilities for defending against new assaults. However, hackers think differently than application developers and are always devising novel attack strategies (Rastogi & Nygard, 2017). The old security strategy centered on devoting resources to safeguard important system components against known threats (Moller & Haas, 2019). Yet, in the cyber world, individually organized and sequential defenses are ineffective. Unless one or more safeguards serve as trip-wires to alert other defenders of an ongoing attack, which is of limited use, attackers can overcome each defense individually (Stytz & Banks, 2004). Flaws are consistently identified in email, web, chat, file transfer, and other services (Schneidewind, 2009).

As seen by prior data breaches and threats, network infiltration can occur by targeting the network’s weakest links (Lusher, 2018). Enterprises suffer large financial losses as a result of information security breaches, as it is difficult to eliminate all vulnerabilities completely. Still, organizations may organize their defense resources to reduce the financial effect of security breaches (Campbell et al., 2003). This move shifts the responsibility for dealing with insecurity on customers who lack the competence to fix the things they have purchased (Shostack, 2005). Cyberattacks make use of computers, networks, smart hardware devices, and other assets as agents, helpers, or targets (Moller & Haas, 2019). Currently, the bulk of cyberattacks focus on application vulnerabilities caused by software bugs or design flaws (Jang-Jaccard & Nepal, 2014). Many effective hackers are able to get access to victim networks using accessible public interfaces without using advanced hacking methods (Borky & Bradley, 2018).

Cybersecurity challenges for software vendors

Software vendors face distinct cyber security challenges concerning other corporate threats. Studies show that 60 percent of open-source code bases contain high-risk vulnerabilities, suggesting that increasing reliance on third-party components in software development has led to the emergence of new vulnerabilities (Ayala, Tung & Garcia, 2025). The SolarWinds incident (Mızrak, 2024) shows that vendor systems are particularly vulnerable to supply chain attacks using compromised updates or dependencies as a vector of attack. Khan et al. (2022c) noted that legacy systems in vendor organizations often lack modern encryption standards (Cerrudo, 2015), and 78 percent of vendor breaches are caused by insecure APIs or misconfigured cloud services (Wicky, Willie & Eshleman, 2020).

Prioritization techniques in cybersecurity context

Prioritization techniques like Fuzzy-TOPSIS have become popular in cyber risk assessment because they effectively manage ambiguity in expert opinions. The work of Arellano et al. (2024) demonstrated the effectiveness of the ranking of cloud security threats, obtaining 89 percent agreement among reputable experts. Comparative studies show that Fuzzy-TOPSIS outperforms Analytic Hierarchy Process (AHP) in terms of reliability, reducing the discrepancy by 40 percent (Wardana & Rianto, 2021). Recent applications include: priority fixing of vulnerabilities (Djambazova & Andreev, 2023), security budget allocation for small and medium-sized enterprises (SMEs) (Dietz, 2023), zero-day vulnerability scorecards (Mohideen et al., 2024), and the Cisco 2024 Cybersecurity Report which shows that 62 percent of vendors now use multi-criteria decision making (MCDM) techniques, with Fuzzy-TOPIS being the second most adopted after VIKOR (Agaba et al., 2024). For several enterprises and businesses related to wired networks, wireless networks, ad-hoc networks, the Internet of Things, etc. is a serious problem (Khan et al., 2022a, 2019, 2020; Farooqi et al., 2019; Khan et al., 2021a; Hosseinzadeh et al., 2022; Lansky et al., 2022; Adnan Khan et al., 2022; Khan et al., 2024; Khan, Abbas & Khan, 2016; Guo et al., 2023).

Systematic literature review

We employed the SLR to identify significant cyber security issues, which produces more efficient, practical, and detailed outcomes than a standard literature study. In this research study, we followed the recommendations of Kitchenham & Charters (2007). The three important stages in this SLR guidelines are as follow.

Conducting the review

Final selection of the articles

Originally, by searching through various data sources using search strings, we were able to find a total of 21,222 research articles. Using the procedures described in the previous section, we were then able to locate 169 original research publications. By applying the inclusion and exclusion criteria, 44 relevant research articles were finally selected, but they were of minimal size and did not meet our requirements, so we used the snowballing method to find 23 relevant research articles. Eventually, 67 research articles were selected for the data collection process, as illustrated in Fig. 2.

Data extraction and evaluation

The data-gathering step follows the primary study of the chosen published studies and is aligned with the research questions. The 67 research articles found and chosen for the suggested SLR were carefully evaluated with the assistance of a secondary reviewer (supervisor). Through the planned SLR study, we first determined the concept of the research study, concepts, and security challenges. Finally, 13 critical cyber security challenges have been identified.

Reporting the review

Quality evaluation

We conducted a performance analysis of the relevant literature after selecting relevant research articles. We evaluated a 50% mark as a quality target significance for our chosen related articles incorporated.

Publication year

During the collection of data phase, SLR retrieved all feasible related details from the 67 issued publications, containing the release year, as shown in Fig. 3.

We tried to include the newest articles in our extraction phase, our chosen research study reveals its expanding pattern of publishing, published from 2001 to 2025, and recognized relevant articles in the domain of cyber security challenges from 2001 to 2025. As a result, this analysis indicated that cyber security is a very hot and wide topic of current research.

Empirical study

The empirical research approach is particularly effective and essential for collecting globally distributed data sources. To prevent ambiguity and uncertainty, we selected a questionnaire survey technique with Google Survey Form to address RQ1 and RQ2. This approach is an effective and useful method for gathering responses from geographically separated people. The survey was conducted systematically by several researchers to ensure rigor and neutrality. This structured approach ensured that the study followed the SLR methodology of Kitchenham & Charters (2007) and maintained transparency and reliability. The roles were as follows:

Researcher 1: Designated the initial search of the database and carried out the screening based on the inclusion and exclusion criteria.

Researcher 2 and 3: Assessed and validated the final selection of the articles.

Fuzzy set theory

The fuzzy set theory was created to eliminate the ambiguity or fuzziness caused by human perceptions in multicriteria decision-making (MCDM). Alshahrani et al. (2022) developed this set theory, where the primary computational methods of opacity concern are fuzzy sets and fuzzy logic. The fuzzy set theory was crucial in demonstrating the fuzzy and uncertain data. Figure 4 depicts the realistic procedure of the fuzzy analytic hierarchy process (F-AHP), which includes all six steps (Dwi et al., 2018).

Definition of triangular fuzzy numbers

In fuzzy decision-making, inaccurate or imprecise data is represented by triangular fuzzy numbers (TFN). The Fuzzy AHP and Fuzzy-TOPSIS approaches are combined with TFNs in this work to prioritize cybersecurity issues. Experts assign linguistic values such as equal importance, modest importance, strong importance, very strong importance and extreme importance after evaluating criteria pairwise using TFN-based decision-making. The notation (l, m, and u) represents a TFN, where:

• The l (Lower Bound) reflects the fuzzy number’s lowest possible value.

• m (Mean Value) represents the middle or most likely value.

• The upper bound (u) represents the maximum possible value.

The membership function F(x) is used to determine the fuzziness of each integer, which spans from 0 to 1, ensuring that uncertainty in expert assessments is accurately recorded and processed (Wu & Tan, 2006; Ecer, 2022).

SLR findings

For RQ1, the suggested method used the SLR methodology to identify 13 major cybersecurity problems. The extraction method begins by evaluating 149 primary articles against preset inclusion and exclusion criteria. At this level, 44 research articles were chosen. Because the number of final articles was quite small, the snowballing approach was used, resulting in the inclusion of an extra 23 articles. As a result, a total of 67 articles were selected for analysis. Through qualitative coding of these investigations, common themes were found, aggregated, and evaluated by domain experts, resulting in the identification of 13 significant cybersecurity challenges, which are described in Table 2. These cybersecurity challenges are “Cyber Security issues”, “Lack of proper awareness”, “Lack of proper framework”, “Skillful staff absence”, “Lack of Quick response in emergency”, “High expenses”, “Lack of privacy”, “Management issues”, “Malicious activities”, “Resource absences”, “Confusion on System measurement”, “Human error during software development” and “Non reliability”.

These recognized security concerns were then mapped using the cyber security challenges model (CSCM), which will aid software suppliers’ organizations in developing software applications at four levels: awareness “A,” management “M,” security “S,” and eminence “E.” Table 3 shows the label “CCSC” for each recognized challenge.

We have supervisor support, SLR, and a questionnaire survey to help us categorize important security concerns. Following that, we performed two case studies in software supplier companies to evaluate our security model, CSCM, in a real-world setting.

We developed the CSCM to classify and rank the 13 identified cyber threats. The model is divided into four interconnected levels, which cover the major areas of cyber security risk faced by software vendors throughout the software development lifecycle: awareness (A), management (M), security (S), and reputation (E).

Awareness: Table 3 shows the 1st level of security model, that consist of significant problems “Lack of proper awareness”, “Lack of proper framework”, “Skillful staff absence”, and “Confusion on System measurement”. In our concept, awareness is computed as a benefit criterion depending on the type of criteria following a thorough conversation with computer professionals.

Management: this is the proposed designed model of second level, which contains the significant issues of “Management issues”, “Resource absences”, and “Human error during software development”. Management, according to IT professionals, is also a benefit criterion due to the above key issues.

Security: Security is the third level, which is highly significant due to the greatest crucial challenge of “Cyber Security issues”. Other important problems at this level are “Lack of Quick response in emergency,” “High expenses,” and “Malicious activities.” As all these difficulties are close to FPIS and far from FNIS, IT professionals label this level benefits criterion.

Eminence: This is the final level of the proposed established security model, that encompasses “Lack of privacy” and “Non reliability”. Considering the “Lack of privacy” and “Non reliability” aspects, the “eminence” criteria are computed as the cost criteria.

Fuzzy TOPSIS application technique

We categorized and ranked the recognized complex by security challenges by Fuzzy TOPSIS to reply RQ2 in cyber security. Many scholars employed the same process, for example, in an extended Pythagorean fuzzy environment, Chen (2021) implemented the fuzzy AHP technique for multiple evaluations with risk ranking.

As the same concern of ambiguity exists in our scenario, we used the same technique as described in ‘Empirical study’, following all of the procedures outlined above:

Step 1: We picked parameters (awareness “A,” management “M,” security “S,” and eminence "E") for the analysis of recognized security issues prioritizing and ranking.

Step 2: As considered in Eq. (1), the proposed method calculate the matrix based performance on various specialist decisions. Since each of the answers is first expressed in linguistic expressions, variables are allocated to every possibility; for instance, the scores of the language words “equal importance (EI)” and “extreme importance (EI)” are (1, 1, 1) and (9, 9, 9), respectively. Table 4 shows the concerning awareness about the performance matrix; the same performance matrix will be generated for management, security, and eminence in Tables 5, 6 and 7, respectively.

Step 3: Applying Eq. (3), the accumulated fuzzy weights of each criterion are determined, and the combined matrix of all the attributes/issues with those of criteria/levels is presented underneath in Table 8.

Step 4: Applying Eqs. (5) and (6), described the combined decision matrix as shown in Table 9, and the normalized matrix from normalized fuzzy weight are shown in Table 10, as well as benefit in term of cost criterion. Because of the lack of confidentiality, trust, and quality attributes, the criterion of “eminence” is computed as the cost criterion, but the other criteria “awareness,” “management,” and “security” are chosen as benefits criteria. After applying the formula, we obtained the given outcomes.

Step 5: The weighted normalized fuzzy matrix is created in this step by multiplying the weight of each criterion by the weight of each alternative. Table 11 shows the resulting weighted normalized decision matrix as obtained by applying Eq. (7).

Step 6: To compute FPIS and FNIS (Iqbal et al., 2024; Mete et al., 2019), the chosen cost criterion is “eminence,” and the remaining benefit criteria are “awareness,” “management,” and “security.” Following a thorough deliberation with research professionals, these criteria are chosen based on their nature. The criterion with the longest distance from FNIS and the smallest distance from FPIS is the best of all. Equations (8) and (9) are used to determine the values, which are displayed in Table 12.

Step 7: Utilizing Eqs. (10) and (11), we measured the distance between all alternatives and FPIS and FNIS. We evaluated each alternative distance from FPIS and FNIS utilizing the same process and formulas and then derived d* and d− by summing all the alternatives concerning each criterion, as shown in Tables 13 and 14.

According to Figs. 5 and 6, the distance of FPIS in respect of CCSC1 is “0.12”, and has the highest distance from FNIS, which is “0.38.” As shown in Fig. 7, the values demonstrate that CCSC1 is the best alternative/challenge among all the other issues of cyber security challenges.

Step 8: Using Eq. (12), we calculated the closeness of coefficient index values (CCi) for each possibility. Table 15 illustrates the ultimate estimated CCi results for all 13 significant security problems.

According to Fig. 8, the security challenge “security issues/access of cyber-attacks (CCSC1)” is the best-ranked critical cyber security challenge with a consistency coefficient value of 0.768, as supplier companies have protection, privacy, and confidentiality issues for essential user information during software development. As a result, software providers’ enterprises must prioritize “Cyber Security issues” throughout software development.

Identification of security challenges

Following a thorough examination and evaluation of the research studies, 13 significant security issues that can positively affect software vendor organizations were recognized, as indicated in Table 15. To better understand this, we examined the distribution of these problems across the different levels of the CSCM model, which allowed suppliers to focus their efforts on the relevant layers of the organization (e.g., policy vs implementation). In addition, several barriers, such as the “Lack of proper awareness” or “Malicious activities” are in line with the larger patterns highlighted in recent publications on threat intelligence, which highlight the relevance and application of our findings.

Validation of security challenges

We used the methodology of a questionnaire survey to validate the identified security challenges from software industry professionals. The findings demonstrate how the recognized cyber security issues have a favorable influence on vendor companies during software development, based on comments from 35 IT specialists.

The validation process has shown a consistent scientific consensus on the critical importance of several key issues, in particular those related to the design of secure architecture and the preparation of response to incidents. This not only reinforces the reliability of our findings but also shows how closely the experience in the field fits the literature’s concerns. This association gives confidence in the universality and relevance of the problems identified.

Prioritization of security challenges

In decision-making criteria, ambiguity and confusion play an essential role. To prioritize cyber security concerns, we observed the entire guidelines of the fuzzy TOPSIS technique. The CCi values are used to categorize the cyber security challenges that have been recognized. This technique thoroughly ranks all possibilities, which will assist IT experts in reconsidering their policies and guidelines for cyber security protection. The topmost rated cyber security issues that should affect software provider companies during software development are CCSC1 “Cyber Security issues,” CCSC2 “Lack of proper awareness”, and CCSC13 “Lack of Quality, Liability and Reliability”.

Priority findings have important implications for practice. The cybersecurity spectrum in the creation of cutting-edge technologies has also been the subject of recent studies. For instance, Khan et al. (2024) looked at how supply chain elements enabled by AI are growing more susceptible to cyberattacks, where AI-enabled SBOMs offer both potential advantages and disadvantages. The study’s findings support the CSCM model’s emphasis on multi-criteria ranking of critical issues and lay the groundwork for future research into vendor organization supply chain dependencies. They did this by using a Fuzzy-TOPSIS approach to provide a structured risk prioritization of vulnerabilities in new software bills of materials (SBOMs) (Radanliev, Santos & Brandon-Jones, 2024). Similar to this, Khan et al. (2022a) looked into AI security and cyber risk in IoT systems, pointing out new vulnerabilities that arise when AI-driven automation and networked IoT environments come together (Radanliev et al., 2024). Our top priorities of “Cyber Security issues” and “Lack of proper awareness” are in line with the threats that have been identified, such as exposure to advanced persistent threats and insufficient security frameworks. Matching our findings with these modern viewpoints implies that the CSCM model can be used in broader contexts where AI and IoT are essential components of intricate software supply chains, in addition to traditional software vendor contexts.

Our results also support a number of long-standing concerns in cybersecurity research when compared to more extensive earlier work. We identified “Lack of proper awareness” as a top-ranked issue, which is consistent with studies like Öğütçü, Testik & Chouseinoglou (2016) and Akter et al. (2022) and that highlight the importance of “cybersecurity awareness” and human factors in risk mitigation. Likewise, previous systematic reviews (e.g., Uchendu et al., 2021) echoed our findings on “Cyber Security issues” and “Lack of Quality, Liability, and Reliability” by highlighting persistent vulnerabilities resulting from inadequate security practices in vendor organizations. But by placing these insights within a structured, multi-criteria decision-making process that has been verified by professionals in the field, the CSCM model goes beyond a simple list of problems and offers a framework for setting priorities for real-world action. This comparative positioning shows that although our findings are consistent with previous research, they add to the body of knowledge by providing a practical, vendor-specific model for tackling cybersecurity issues in software development.

The highest-rated issue, “Cyber Security issues, for example, stresses the critical need for robust authentication mechanisms, threat detection systems, and regular penetration testing throughout the life of the software”. Similarly, the shortage of good knowledge highlights the critical need for continued cyber-training programs and knowledge-sharing frameworks in software development teams. Finally, the “lack of quality, liability and reliability” highlights concern about the quality of secure code and highlights the importance of incorporating the principles of the secure development lifecycle (SDLC) into vendor processes. Combined, the prioritized list provides actionable knowledge for software vendors and can be used to build cyber maturity models, conduct internal risk assessments, or guide investments in secure development resources.