The classification of security vulnerabilities is a crucial but tedious task. Each entry in the Common Vulnerabilities and Exposures (CVE) catalog must be tagged with one or more Common Weakness Enumeration (CWE) categories to facilitate analysis and mitigation. Currently, much of this process is done manually, slowing down threat response and opening the door to human error. An artificial intelligence-based approach can automate this work, but the choice of classification model is decisive. In this article we analyze two opposing formulations: the multiclass model, which assigns a single CWE per CVE, and the multilabel model, which allows multiple assignments. Both have been evaluated with different variants of the BERT transformer on label spaces of different sizes.
Multiclass classification simplifies the problem by forcing each CVE to belong to a single class. This is efficient when vulnerabilities are very specific, but it does not reflect the reality of many hybrid cases. In contrast, multilabel classification recognizes that a single flaw can fit into multiple weaknesses, offering a more faithful representation. However, training a multilabel model is more complex, as it must learn to predict sets of labels and handle dependencies between them. In recently published experiments, the multiclass approach achieved higher macro-F1 in all scenarios, although the advantage narrowed drastically as the number of classes decreased. With 25 categories, the difference dropped to only two percentage points, and threshold optimization on the multilabel side allowed results to match. This suggests that with a reduced label space, both approaches are practically interchangeable.
The encoders used were BERT Base, SecureBERT, and CySecBERT. The latter two are pre-trained on cybersecurity corpora, which could give them an advantage in understanding technical descriptions. CySecBERT showed the best overall performance, with statistically significant improvements especially in the multilabel setup. This result reinforces the idea that a model specialized in the security domain better captures the nuances of vulnerability reports. For companies developing custom software in the cybersecurity field, having an automatic tagging system based on CySecBERT can speed up audit and compliance processes.
A relevant finding of the study is that error patterns are very similar across the three encoders, with a Pearson correlation above 0.92. The most frequent confusions follow the CWE hierarchy: the model tends to confuse one category with another that is in the same branch of the taxonomic tree. This indicates that the error structure depends more on the design of the taxonomy itself than on the specific model. When a relaxed evaluation was applied that forgives confusions within the same weakness family, macro-F1 jumped from around 81% to approximately 90%. This data is vital for cybersecurity teams: strict metrics can underestimate the real quality of a branch-level classifier.
What implications does this have for a software development company like Q2BSTUDIO? Our team integrates artificial intelligence solutions in cybersecurity platforms for clients who need to protect their cloud infrastructures on AWS or Azure. An automated CVE-CWE mapping system, based on specialized BERT models, can be embedded in vulnerability analysis pipelines. Additionally, we combine these classifiers with AI agents that perform contextual searches and generate smart reports. For example, when a new CVE is detected, the agent can query the multilabel model, assign the relevant CWEs, and then feed a Power BI dashboard for analysts to visualize trends and prioritize patches. All of this is developed on scalable cloud architectures, ensuring low latency and high availability.
The choice between multiclass and multilabel is not trivial. If the goal is quick assignment and higher precision in environments with many categories, the multiclass model may be preferable. But when granularity is required and vulnerabilities are complex, the multilabel approach offers a more complete representation. Research shows that with a reduced number of classes, both options converge. At Q2BSTUDIO, when designing custom cybersecurity solutions, we evaluate these alternatives based on the specific needs of the client. Our expertise in artificial intelligence allows us to optimize decision thresholds and select the most suitable encoder for each use case, whether SecureBERT for technical documents or CySecBERT for exploit descriptions.
Looking to the future, the integration of autonomous AI agents promises to revolutionize CVE-CWE mapping. These agents will not only classify but also enrich records with additional context, such as available patches or impacts on specific systems. Companies already working with custom applications and AWS/Azure cloud can benefit from these advances without large investments. At Q2BSTUDIO, we combine BI/Power BI with language models to offer interactive dashboards that allow security teams to make informed decisions in real time. Automating software processes, such as vulnerability tagging, reduces costs and accelerates incident response.
In conclusion, the debate between multiclass and multilabel with BERT for CVE-CWE mapping has no absolute winner; it depends on the context. Experimental results show that the underlying taxonomy influences more than the model architecture, and that a relaxed evaluation provides a more realistic picture of performance. For organizations looking to implement artificial intelligence solutions in cybersecurity, it is essential to understand these nuances and have a technology partner that knows how to apply them. Q2BSTUDIO, with its experience in custom software development, cloud computing, and AI agents, is ready to help its clients take the leap toward smarter, automated vulnerability management.
