Stefan Rass

The consideration of uncertainty is a central but frequently inadequately addressed component of risk management. A systematic treatment of uncertainty is essential for ensuring the quality and traceability of decision-making processes, particularly in complex and safety-critical environments. This review systematically analyzes how established risk management approaches conceptualize and represent uncertainty in both their theoretical foundations and practical applications. Based on a systematic literature review of 370 publications, the identified approaches are classified into five methodological families. These include probabilistic methods, evidence-based and fuzzy-logic approaches, qualitative elicitation techniques, graphical and visual representations and hybrid frameworks. The analysis shows that probabilistic methods remain predominant due to their quantitative rigor, whereas fuzzy and evidence-based approaches are particularly suited to addressing vagueness and epistemic uncertainty. Qualitative and graphical approaches are found to enhance interpretive understanding and support the transparent communication of uncertainty. Despite these developments, the analysis indicates that the practical integration of these approaches into operational risk management remains limited in many domains. The findings highlight the need for more structured guidance in method selection and suggest that future research would benefit from further development of hybrid approaches and visualization techniques.

Cybersecurity superintelligence--artificial intelligence exceeding the best human capability in both speed and strategic reasoning--represents the next frontier in security. This article will present the emergence of such capability through three of our major contributions that have helped pioneered the field of AI Security and are being used in the Cyber Battlefield today. First, PentestGPT (2023) established LLM-guided penetration testing, achieving 228.6% improvement over baseline models through an architecture that externalizes security expertise into natural language guidance. Second, Cybersecurity AI (CAI, 2025) demonstrated automated expert-level performance, operating 3,600× faster than humans while reducing costs 156-fold, validated through #1 rankings at international competitions including the $50,000 Neurogrid CTF prize. Third, Generative Cut-the-Rope (G-CTR, 2026) introduces a neurosymbolic architecture embedding game-theoretic reasoning into LLM-based agents: symbolic equilibrium computation augments neural inference, doubling success rates while reducing behavioral variance 5.2× and achieving 2:1 advantage over non-strategic AI in Attack & Defense scenarios. Together, these advances establish a clear progression from AI-guided humans to human-guided game-theoretic cybersecurity superintelligence.

Security often receives insufficient developer attention because it does not directly generate visible value, leading to underinvestment in practice. We evaluate a countermeasure by team-level incentives tied to measurable security improvements over time. Our semi-automated mechanism aggregates static analysis findings from Bearer, Detekt, and mobsfscan, computes security issue density, and rewards teams based on the relative improvement ratio across sprints, enabling repeatable, scriptable reporting at scale. In a controlled course experiment with 84 students across 14 teams, we compared a security-incentivized condition, in which bonus points were linked to security scanner results, against a control condition with an otherwise identical grading scheme. The treatment group achieved significantly lower security issue density overall (beta regression: $β= -0.396, p = 0.0342$), indicating improved measurable security under incentivization. After controlling for platform, we observed a marked front-end/back-end disparity, with back-ends showing fewer issues and higher improvement ratios under incentives, highlighting heterogeneous effects across stack layers. Notably, these gains were not the byproduct of inflated code volume, as lines of code increased similarly across groups over time. The measurement pipeline and toolchain proved feasible for scripting and automation, supporting scalable adoption in practice. Our results suggest that aligning rewards with automated security metrics can measurably improve code security and merit follow-up in professional contexts and longer development lifecycles.