A Neuro-Symbolic Risk Calculus for Quantifying Security Posture in Microservice Systems

The decentralized nature of microservices fuels development agility but introduces architectural opacity. Consequently, inconsistent security assumptions emerge across services creating latent vulnerability surfaces. While traditional inter-procedural static analysis methods excel in monolithic or homogenous environments, they struggle to construct a unified "super-graph" in polyglot, dynamically routed distributed systems. This work presents a neuro-symbolic framework that moves beyond conventional static analysis by quantifying a system's holistic security posture by formally modeling the uncertainty inherent in these decoupled architectures. Our approach transforms static Intermediate Representations into a Knowledge Graph, grounding this symbolic model with business context inductively inferred by a Large Language Model. We then employ Subjective Logic to develop a novel risk calculus to reason about evidence from these two sources. Unlike traditional binary scoring, our model produces a multi-dimensional "opinion" tuple (b,d,u) for each execution path. This dataset contains the results from the empirical evaluation on the TrainTicket benchmark. We demonstrate that this framework identifies critical latent vulnerabilities in paths deemed "clean" by industry-standard SAST tools (SonarQube). By explicitly distinguishing between probabilistic business conflicts and deterministic security negligence, the model moves beyond binary alerting to provide a granular risk profile, enabling automated governance that balances operational availability with security rigor.