Vulnerability management in cybersecurity is a constant challenge for enterprises, especially when it comes to correctly classifying each incident according to the Common Weakness Enumeration (CWE). Manually assigning CWE categories to Common Vulnerabilities and Exposures (CVE) records is slow, error-prone, and does not scale. That is why automation through artificial intelligence techniques has become a priority. A recent study compares two classification approaches using transformers like BERT: multi-class, which predicts a single CWE per CVE, and multi-label, which allows assigning multiple categories. This article analyzes their differences, strengths, and business applications, highlighting how custom software solutions can integrate these models into real-world environments.
Multi-class classification treats the problem as a scenario where each CVE belongs to a single CWE, simplifying training and evaluation. On the other hand, multi-label classification recognizes that a vulnerability may have multiple underlying weaknesses, reflecting technical reality more accurately. The study tested three transformer encoders (BERT Base, SecureBERT, and CySecBERT) on nested label spaces of 83, 47, and 25 classes. Results show that the multi-class approach achieves a higher macro-F1 in all cases, although the gap compared to multi-label narrows from 21 to only 2 percentage points when the label space shrinks to 25 classes. This suggests that with fewer categories, the multi-label model can match the multi-class one if the decision threshold is optimized.
A key finding is that error patterns are very similar across the three encoders. The most common confusions follow the CWE hierarchy: classifiers tend to confuse nearby categories in the taxonomic tree. This indicates that the taxonomy structure influences errors more than model choice. In fact, when evaluating with a metric that forgives confusions within the same family (hierarchy-relaxed evaluation), macro-F1 jumps from around 81% to 90%, revealing that models are much more accurate at the branch level than strict metrics suggest. CySecBERT, a model pre-trained on cybersecurity text, achieves the best overall results, especially in the multi-label scenario.
From a business perspective, these advances open the door to automated vulnerability triage systems that reduce the burden on security teams. However, deploying such a classifier in production requires more than just picking the right model. It must be integrated into cloud platforms, such as AWS or Azure, to process large volumes of data in real time, and combined with Business Intelligence dashboards (e.g., Power BI) to visualize trends. Moreover, incorporating AI agents can automate responses to classified vulnerabilities, accelerating mitigation.
Q2BSTUDIO, as a software development and technology company, offers specialized services in custom software that incorporate advanced classification models. For example, a tailored system could ingest CVE feeds, apply a transformer like CySecBERT to predict corresponding CWEs, and then feed a Power BI dashboard so analysts can prioritize patches—all on scalable cloud infrastructure, ensuring performance and security. The choice between multi-class and multi-label will depend on the granularity required by the organization: if a single main category suffices, the multi-class approach is more robust; if all weaknesses must be captured, the multi-label variant with threshold tuning is equally effective.
In conclusion, automatic classification of CVE to CWE using transformers is a viable and accurate solution, especially when leveraging specialized models like CySecBERT. The decision between multi-class and multi-label should be based on the operational context and downstream processing capacity. Companies wanting to leap into cybersecurity automation can rely on technology partners like Q2BSTUDIO to design custom applications that integrate AI, cloud, and BI, achieving more efficient and proactive vulnerability management.
