Towards a Theory of Quantitative Vulnerability Analysis for Engineering Systems
Abstract
Since the 1980s, risk analysis for engineering systems has been defined based on a tuple of scenarios, 𝒮, likelihoods, L, and consequences, C, where Risk = (𝒮,L,C). We argue that equating this triplet with risk alone is insufficient and potentially misleading. Instead, we define this tuple as a vulnerability space 𝒱 = (𝒮,L,C), which becomes risk only when one makes specific interpretations of likelihood and consequence. Here, an interpretation has mathematical meaning, and defines a map that assigns data elements about system vulnerability to a perspective. Formally, we define a vulnerability perspective as a specific choice of interpretations of likelihood and consequence data that allows vulnerability analysis measures to be defined and analyzed. We argue that risk is only one of four common perspectives on 𝒱 and demonstrate mathematically why each perspective should remain a distinct concept. First, we show how interpretation of C as a set-valued function produces reliability measures, not risk measures. Then, we show how interpretation of L via possibility theory will produce adversarial and safety measures distinct from risk. This new theoretical framework clarifies the conceptual, mathematical, and practical differences between risk, reliability, adversarial, and safety perspectives---four common engineering system analyses often conflated in the literature. A consequence of our theory is that no single perspective will reveal all vulnerabilities of an engineering system, suggesting decision-making via risk analysis may incur unavoidable and underappreciated tradeoffs from other vulnerability perspectives.
Related
- Dissipative Systems Analysis and Control. Theory and Applications: Erratum/Addendum. Springer Nature Switzerland AG, Communications and Control Engineering, Third uncorrected Edition, 2020
- Quantitative orbit equivalence for rank-one systems
- Quantitative propagation of chaos for particle systems with memory and their long-time behaviour
- A point-free theory of quantitative homogenization
- Quantitative propagation of chaos in total variation for unregularized Vlasov-Riesz-Fokker-Planck systems
BibTeX
@misc{eisenberg2026towards,
title = {{Towards a Theory of Quantitative Vulnerability Analysis for Engineering Systems}},
author = {Daniel A. Eisenberg and David L. Alderson},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.02424},
eprint = {2610.02424},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.02424},
}
RIS
TY - UNPB
TI - Towards a Theory of Quantitative Vulnerability Analysis for Engineering Systems
AU - Daniel A. Eisenberg
AU - David L. Alderson
PY - 2026
DA - 2026/10/01
PB - arXiv
DO - 10.48550/arxiv.2610.02424
UR - https://arxiv.org/abs/2610.02424
AB - Since the 1980s, risk analysis for engineering systems has been defined based on a tuple of scenarios, 𝒮, likelihoods, L, and consequences, C, where Risk = (𝒮,L,C). We argue that equating this triplet with risk alone is insufficient and potentially misleading. Instead, we define this tuple as a vulnerability space 𝒱 = (𝒮,L,C), which becomes risk only when one makes specific interpretations of likelihood and consequence. Here, an interpretation has mathematical meaning, and defines a map that assigns data elements about system vulnerability to a perspective. Formally, we define a vulnerability perspective as a specific choice of interpretations of likelihood and consequence data that allows vulnerability analysis measures to be defined and analyzed. We argue that risk is only one of four common perspectives on 𝒱 and demonstrate mathematically why each perspective should remain a distinct concept. First, we show how interpretation of C as a set-valued function produces reliability measures, not risk measures. Then, we show how interpretation of L via possibility theory will produce adversarial and safety measures distinct from risk. This new theoretical framework clarifies the conceptual, mathematical, and practical differences between risk, reliability, adversarial, and safety perspectives---four common engineering system analyses often conflated in the literature. A consequence of our theory is that no single perspective will reveal all vulnerabilities of an engineering system, suggesting decision-making via risk analysis may incur unavoidable and underappreciated tradeoffs from other vulnerability perspectives.
ER -