Modern microservices architectures suffer from the fragmented observability problem: Static Application Security Testing tools analyze the code but miss the runtime context; log analysis tools observe the failures but miss the root cause; and risk metrics (such as CVSS) flatten these complex realities into static scalar scores. This paper proposes a Holistic Risk Calculus that unifies these disparate signals. We present a framework that fuses structural evidence (from static analysis), semantic evidence (from semantic dependency graphs), business context (using Large Language Models), and dynamic evidence (from logs and traces). By leveraging Subjective Logic, we replace binary security flags with multi-dimensional "opinions" (belief, disbelief, uncertainty). Furthermore, our calculus could be used to perform abductive reasoning, allowing the system to not only quantify risk but to autonomously reason backwards-from runtime log anomalies to latent vulnerabilities, enabling self-diagnosing security postures.

@inproceedings{WeerasingheC26,
  title = {A Holistic Risk Calculus for Microservice Systems using Multi-Source Signal Fusion},
  author = {Shakthi Weerasinghe and Tomas Cerny},
  booktitle = {FSE},
  year = {2026},
  doi = {10.1145/3803437.3806089}
}