Forecasting Threats is Way Easier Than You Think
summary
Claim: forecasting breach likelihood is practical by measuring tendencies, not exact probabilities. Uses the Veris Community Database CSV (≈9,000 incidents, >2,000 columns), filters by industry, and aggregates with pivot tables to show consistent patterns (e.g., healthcare shifts from personnel error to ransomware dominance by 2019). Introduces a pragmatic likelihood “slide‑rule” that maps quintiles to control maturity and promises an automated implementation in CIS RAM 2.0 for risk-based prioritization.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:01Which is the definition of "risk management"...
- 5:32A new kind of likelihood question emerges
- 6:54Outcomes of Accurate Predictions vs Forecasts
- 12:28Know Your Business: Where is Sensitive Business Done? / Which Assets?
- 17:48Test the Hypothesis: What Business Is This?
- 25:28Using Forecasts in Risk Analysis
- 27:09Mitigate the Commonality by the Strength of Controls
- 30:01Duty of Care Risk Analysis
- 30:18New Legal Interpretation of Reasonable Controls
- 31:40Forecasting Threats Next Week
- 32:10Forecasting Threats Three Months
- 33:51Forecasting Threats Six Months
related talks
54mTowards Real World Cyber Risk (Panel)
51mFAIR STRIDE - Building Business Relevant Threat Models
33mForecasting Vulnerability Sightings Under Data Scarcity: Modeling Sparse and Bursty Cyber Threat ...
43mChanging from Probability to Prioritization Method in Risk Measurement
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)
27mFrom Attacks to Action - Building a Usable Threat Model to Drive Defensive Choices
51mSecurity's Holy Grail: Predicting Attacks Before They Happen
37mWhat a Year! - Insights and Forecasts from the 2021 DBIR