About the Authors and This Research

This paper was led by Professor Cinzia Bernardeschi of the Department of Information Engineering at the University of Pisa, Italy, co-authored with Francesco Merola and Giuseppe Lami. Professor Bernardeschi brings substantial academic authority to this work, with an h-index of 19 and 1,194 cumulative citations in formal methods, embedded system verification, and safety-critical systems engineering across aerospace and automotive domains. Published in 2024 and already cited 10 times, the paper has attracted rapid peer recognition, signaling genuine methodological relevance to the research community.

Crucially, the authors validated their framework against a case study drawn directly from ISO/SAE 21434—the global standard for automotive cybersecurity engineering—making this research immediately applicable to practitioners navigating TISAX certification and UNECE WP.29 UN-R155 compliance requirements. This is not a theoretical exercise: the paper is a constructive critique of an existing, widely-used standard, and proposes a mathematically grounded improvement that preserves full interpretability.

The Core Problem: How Discrete Scoring Creates Blind Spots in Automotive Cybersecurity Risk Assessment

The fundamental challenge addressed by this research is one that every automotive cybersecurity practitioner encounters but rarely quantifies: conventional risk assessment scales—typically discrete ordinal scales for attack feasibility and safety impact—compress genuinely different risk profiles into identical output values. Two distinct attack vectors, with meaningfully different characteristics, can yield the same final risk rating, effectively erasing decision-relevant information before it reaches engineering or management teams.

This information loss is not a minor inconvenience. Under ISO/SAE 21434, TARA outputs directly inform cybersecurity goals, security controls selection, and residual risk acceptance decisions. If the TARA engine discards information through coarse quantization, downstream decisions—including those evaluated by TISAX assessors—rest on an unnecessarily blunt foundation.

Key Finding 1: Fuzzy Membership Functions Capture the Uncertainty That Discrete Scales Discard

The paper's central contribution is replacing hard threshold-based discrete scales with continuous fuzzy membership functions for both input factors: attack feasibility and safety impact. Rather than forcing each input into a fixed category, the fuzzy inference engine models partial membership across multiple linguistic categories (e.g., "low," "medium," "high"), reflecting the genuine ambiguity that cybersecurity engineers face when assessing novel attack scenarios—particularly for connected vehicle systems where empirical attack data is limited.

The result is a risk output expressed not as a single point value but as a value accompanied by a scatter indicator—a measure of the risk trend around the calculated value. This additional dimension enables practitioners to distinguish between a "medium risk" assessment with high confidence and one with substantial uncertainty, a distinction that is invisible to conventional discrete scoring but critical for resource allocation and escalation decisions.

Key Finding 2: Natural Language Control Rules Preserve Traceability—A Direct TISAX Advantage

The fuzzy inference engine is governed by control rules expressed in natural language—for example, "IF attack feasibility is high AND safety impact is severe, THEN risk is critical." This architectural choice is strategically significant for compliance contexts. UNECE WP.29 UN-R155 requires vehicle manufacturers and their suppliers to maintain complete documentation of cybersecurity decision rationale throughout the product lifecycle. A fuzzy engine built on human-readable rules allows audit teams—including TISAX assessors—to directly trace every risk calculation to its logical basis, without confronting an opaque mathematical model.

This interpretability requirement is one area where AI-based risk scoring approaches face significant compliance headwinds; the fuzzy logic framework navigates this challenge by design.

Key Finding 3: The Framework Is General-Purpose and Standards-Compatible

The authors explicitly designed the framework to be applicable across automotive systems independently of specific case studies or vehicle architectures. Validation against the ISO/SAE 21434 case study demonstrated that fuzzy logic outputs align with conventional TARA results while providing the additional scatter information. This compatibility means Taiwanese suppliers—whether producing electronic control units (ECUs), sensors, telematics modules, or in-vehicle software—can integrate this methodology into existing TARA workflows without rebuilding compliance processes from scratch.

Implications for Taiwan's Automotive Cybersecurity Practice

Taiwan's automotive electronics supply chain is navigating a compliance environment that has grown substantially more demanding since 2021, when UNECE WP.29 UN-R155 became mandatory for new vehicle type approvals in key markets. The regulatory pressure now cascades through the supply chain: Tier 1 and Tier 2 suppliers serving European OEMs increasingly face TISAX certification requirements as a condition of partnership, while ISO/SAE 21434 provides the engineering framework underlying both TISAX and UN-R155 conformity assessments.

Against this backdrop, the fuzzy logic framework described in this paper carries three practical implications for Taiwan-based practitioners.

First, the research provides a technically credible pathway to improve TARA precision without disrupting existing compliance infrastructure. Taiwanese suppliers who have already invested in ISO/SAE 21434 TARA processes can treat the fuzzy logic approach as an enhancement layer—particularly valuable for high-uncertainty scenarios such as OTA update pathways, V2X communication interfaces, or newly integrated AI components in OT environments (a concern directly flagged by CISA's 2025 guidance on AI-OT integration security).

Second, the scatter indicator concept reframes how organizations should interpret TARA outputs. A high-uncertainty risk rating is not a weakness in the assessment—it is actionable intelligence indicating where additional threat intelligence investment or deeper analysis is warranted before a cybersecurity goal is finalized. This aligns with the risk-based, continuous monitoring philosophy embedded in both ISO/SAE 21434 and UNECE WP.29.

Third, the paper's implicit critique of discrete scoring should prompt Taiwan's automotive cybersecurity practitioners to examine whether their current TARA outputs are genuinely informing decisions or merely satisfying documentation checkboxes. As TISAX assessors and regulatory bodies grow more sophisticated in their evaluation criteria, the quality and defensibility of TARA methodology—not just its existence—will increasingly differentiate compliant from non-compliant suppliers.

How Winners Consulting Services Co. Ltd. Helps Taiwan's Auto Suppliers Navigate This Challenge

Winners Consulting Services Co. Ltd. (積穗科研股份有限公司) supports Taiwan's automotive supply chain in achieving TISAX certification, implementing ISO/SAE 21434, and meeting UNECE WP.29 UN-R155 vehicle cybersecurity requirements. In response to the TARA precision challenges identified in this research, we provide the following targeted services:

1. TARA Methodology Review and Enhancement: We conduct a structured review of your existing Threat Analysis and Risk Assessment processes, identify scoring blind spots caused by discrete scale limitations, and evaluate the feasibility of integrating fuzzy logic or other quantitative supplementary methods. We ensure TARA outputs meet the traceability standards required by TISAX assessors and UNECE WP.29 audits.
2. ISO/SAE 21434 Gap Analysis and Remediation Planning: Using the full ISO/SAE 21434 clause structure as a benchmark, we systematically assess your current state across cybersecurity management, engineering processes, and verification testing—delivering a prioritized remediation roadmap with realistic timelines designed to achieve compliance within 7 to 12 months.
3. TISAX Assessment Preparation and Coaching: From pre-assessment readiness evaluation through gap remediation, formal assessment application, and post-assessment improvement planning, we provide end-to-end advisory support. We specifically address the documentation quality, cross-functional coordination, and supply chain management challenges most commonly encountered by Taiwan's SME-scale automotive suppliers.

Frequently Asked Questions

How exactly does a fuzzy logic TARA framework differ from the standard ISO/SAE 21434 risk assessment approach?

The core difference lies in how uncertainty is handled. ISO/SAE 21434 TARA conventionally uses discrete ordinal scales—for example, four or five fixed levels for attack feasibility and safety impact. When two different attack scenarios happen to fall in the same scoring band, they receive identical risk ratings despite meaningful underlying differences. The fuzzy logic framework replaces these hard thresholds with continuous membership functions, allowing partial membership across multiple linguistic categories. The output is not just a risk value but also a scatter indicator showing the uncertainty range around that value. For Taiwan suppliers, this means TARA assessments for high-uncertainty scenarios—such as OTA update pathways or new V2X interfaces—can be expressed with greater nuance, improving both decision quality and TISAX audit defensibility. The framework does not replace ISO/SAE 21434 TARA; it augments it.

What are the most common TARA compliance challenges Taiwanese automotive suppliers face under ISO/SAE 21434?

Based on Winners Consulting's advisory experience with Taiwan-based suppliers, three challenges recur most frequently. First, attack feasibility ratings lack empirical grounding: most Taiwanese SME-scale suppliers do not maintain systematic threat intelligence databases, causing Attack Feasibility Ratings in ISO/SAE 21434 TARA to rely heavily on expert judgment without documented evidence—a vulnerability in TISAX assessments. Second, severity level assessments are inconsistent across functions: safety engineering and cybersecurity engineering teams often diverge in their impact evaluations for the same attack scenario, creating TARA documents that cannot withstand cross-functional scrutiny. Third, TARA version control and decision traceability are incomplete, failing to satisfy the continuous monitoring documentation requirements of UNECE WP.29 UN-R155. The natural language rule structure of fuzzy logic inference engines can partially address the first two challenges by making assessment logic explicit and disputable.

What are TISAX's core requirements, and how long does it realistically take a Taiwan supplier to achieve certification?

TISAX (Trusted Information Security Assessment Exchange), administered by the German Association of the Automotive Industry (VDA), is the primary information security certification mechanism for European OEM supply chains. Its assessment criteria reference ISO/IEC 27001 with automotive-specific extensions, and it forms one of three compliance pillars for Taiwan's automotive suppliers alongside ISO/SAE 21434 and UNECE WP.29 UN-R155. Core requirements include establishing an information security management system, managing supply chain security, protecting prototype data (where applicable), and demonstrating cybersecurity incident response capability. In terms of preparation timelines, Winners Consulting's experience shows that suppliers with an existing ISO 27001 foundation typically require 4 to 6 months to close TISAX-specific gaps. Organizations starting from a minimal baseline typically require 9 to 12 months. Key milestones include: gap analysis (1–2 months), system design and documentation (3–5 months), internal audit (1 month), and formal assessment (1–2 months).

What resources are required to pilot a fuzzy logic TARA enhancement, and what ROI can Taiwan suppliers expect?

The resource requirements for piloting fuzzy logic as a TARA supplementary tool are manageable for most automotive suppliers. Technically, the approach requires engineers with basic mathematical literacy—not machine learning specialists—and domain experts (automotive cybersecurity engineers) who can define the natural language control rules. Open-source fuzzy logic libraries (such as Python's scikit-fuzzy or MATLAB's Fuzzy Logic Toolbox) significantly reduce software costs. Expected returns materialize across three dimensions: first, reduced TARA scoring disputes and faster cross-functional consensus—estimated at 20–30% reduction in assessment cycle time for complex scenarios; second, improved TISAX audit defensibility through enhanced documentation traceability; and third, more precise risk prioritization in connected vehicle systems, enabling focused cybersecurity resource allocation. Winners Consulting recommends piloting the framework on 3 to 5 high-uncertainty TARA scenarios before broader adoption.

Why should Taiwan automotive suppliers engage Winners Consulting Services for cybersecurity compliance?

Winners Consulting Services Co. Ltd. (積穗科研股份有限公司) specializes in automotive cybersecurity compliance for Taiwan's electronics and component supply chain, with deep integrated expertise across ISO/SAE 21434, TISAX, and UNECE WP.29 UN-R155. Our competitive advantage lies in understanding Taiwan's organizational reality: most local automotive suppliers are SME-scale, operate with limited dedicated cybersecurity headcount, and require pragmatic compliance pathways—not frameworks designed for large European OEM organizations. We continuously monitor leading academic research, translating findings like the fuzzy logic TARA framework into actionable tools and processes. Our advisory support is designed to help Taiwan suppliers establish auditable, sustainable automotive cybersecurity management systems within 7 to 12 months, achieving European OEM partnership qualification at a cost-effective investment level.

ファジィ論理に基づく自動車サイバーセキュリティリスク評価フレームワーク：台湾自動車サプライチェーンへの示唆

積穗科研股份有限公司（Winners Consulting Services Co. Ltd.）は、2024年に発表された重要な学術研究を注目すべき論文として取り上げます。この研究は、ISO/SAE 21434準拠の自動車サイバーセキュリティリスク評価にファジィ論理（Fuzzy Logic）を初めて体系的に導入し、従来の離散的評点法が抱える「異なる入力値が同一リスク等級に圧縮される」という根本的な精度課題を解決する方法論を提示しています。TISAXの取得やUNECE WP.29（UN-R155）への対応を進める台湾の自動車サプライヤーにとって、この研究はTARA（脅威分析・リスク評価）の信頼性を実践的に向上させる具体的な参照フレームワークとなります。