Cyber Fragility Index (CFI): A Composite Indicator for Predictive Cybersecurity Governance

This article introduces the Cyber Fragility Index (CFI), a composite indicator developed within the APS-CYBER (Adaptive Predictive Systems) framework to support predictive cybersecurity and strategic decision-making. Traditional cybersecurity metrics and Key Performance Indicators (KPIs) provide valuable information about vulnerabilities, incidents, and compliance status, but they often fail to capture the overall trajectory of an organisation's security posture and its proximity to systemic instability. The Cyber Fragility Index addresses this gap by translating a complex set of operational and predictive cybersecurity indicators into a synthetic and actionable measure that can be readily interpreted by senior management and governing boards. Rather than quantifying the number of existing vulnerabilities, the CFI evaluates the degree of fragility of an organisation and its distance from a potential cyber crisis condition. The paper presents the conceptual foundations of the index, its mathematical formulation, the role and interpretation of its four constituent components, and the rationale underlying the weighting model. Furthermore, it describes the hierarchical relationship between the CFI and the operational indicators from which it is derived, demonstrating how predictive cybersecurity data can be aggregated into a strategic governance instrument. The proposed approach contributes to bridging the gap between technical cybersecurity monitoring and executive-level risk management, enabling organisations to identify deteriorating trends, anticipate systemic risks, and support informed decision-making through a predictive and measurable assessment of cyber resilience.