  Attack trees are important for security, as they help to identify weaknesses
and vulnerabilities in a system. Quantitative attack tree analysis supports a
number security metrics, which formulate important KPIs such as the shortest,
most likely and cheapest attacks.
  A key bottleneck in quantitative analysis is that the values are usually not
known exactly, due to insufficient data and/or lack of knowledge. Fuzzy logic
is a prominent framework to handle such uncertain values, with applications in
numerous domains. While several studies proposed fuzzy approaches to attack
tree analysis, none of them provided a firm definition of fuzzy metric values
or generic algorithms for computation of fuzzy metrics.
  In this work, we define a generic formulation for fuzzy metric values that
applies to most quantitative metrics. The resulting metric value is a fuzzy
number obtained by following Zadeh's extension principle, obtained when we
equip the basis attack steps, i.e., the leaves of the attack trees, with fuzzy
numbers. In addition, we prove a modular decomposition theorem that yields a
bottom-up algorithm to efficiently calculate the top fuzzy metric value.
