With ever increasing application of information technologies in every day activities, organizations face the need for applications that provides better security. The existence of complex IT systems with multiple interdependencies creates great difficulties for Chief Security Officers to comprehend and be aware of all potential risks in such systems. Intelligent decision making for IT security is a crucial element of an organization’s success and its competitive position in the marketplace. This paper considers the implementation of an integrated attack graph and a Fuzzy Cognitive Maps (FCM) to provide facilities to capture and represent complex relationships in IT systems. By using FCMs the security of IT systems can regularly be reviewed and improved. What-if analysis can be performed to better understand vulnerabilities of a designed system. Finally an integrated system consisting of FCM, Attack graphs and Genetic Algorithms (GA) is used to identify vulnerabilities of IT systems that may not be apparent to Chief Security Officers.