Predictive threat index

As explained in Data-Driven Cybersecurity

The predictive threat index is a metric that estimates the probability of future cybersecurity incidents from historical attacks, threat intelligence, and real-time monitoring.

The predictive threat index (PTI) estimates the likelihood of future cybersecurity incidents using past attacks, threat intelligence, and current monitoring. Its purpose is to help security teams prioritize likely attack vectors, allocate resources, and prepare a response. Unlike the risk exposure index (REI), which describes overall current risk, PTI looks ahead. section 10.2 section 10.2.2

A practical PTI assessment brings together:

• Historical incidents, to identify attacks that may recur. section 10.2.2
• Threat intelligence, to track observed and emerging attack patterns. section 10.2.2
• Current vulnerabilities and monitoring, to update the assessment as conditions change. section 10.2.2 section 10.2

A basic malware estimate

A simple PTI calculation is incidents × threat likelihood ÷ total assets. With 15 malware attacks in a year, a 30% threat likelihood, and 200 critical assets, the result is 15 × 0.30 ÷ 200 = 0.0225, presented as 2.25%. This gives the security team a figure for prioritization. Treat the simple calculation as an estimate tied to its inputs, rather than a reason to ignore other risks. section 10.2.2

Figure 10.1 The left side shows risk exposure and predictive analytics before implementing improvements. The right side shows the situation afterward.

Compare the before-and-after dashboard with explicit targets. The initial PTI indicates a 60% likelihood of a malware attack in the next six months; the target is below 20%. Review PTI alongside risk exposure, incident frequency, and response time rather than as a standalone verdict. section 10.2.3

To put PTI to work, collect incident and threat data, inspect patterns, and present the forecast in a dashboard. Elastic Stack supports data collection, analysis, and visualization; Wazuh supports real-time monitoring and predictive models. Use the resulting estimate to decide where to strengthen defenses, then revisit it as new information arrives. section 10.2.5 section 10.2.2

How Data-Driven Cybersecurity covers it

How deep it goes

Defines predictive inputs and works a basic calculation, while describing machine learning without specifying a model.

Examples

Calculates a 2.25% malware PTI from attacks, threat likelihood, and assets; compares a dashboard baseline with improvement targets.

What it assumes

Uses incident records, threat intelligence, asset counts, and basic arithmetic; introduces the PTI calculation explicitly.

What you can do after

Apply it via Elastic Stack or Wazuh to examine threat patterns and inform security priorities.

How it connects

Connects predictive analytics with threat intelligence, vulnerability management, and the risk exposure index.

liveBookmanning.com

Read Data-Driven Cybersecurity on liveBook Get the book at manning.com

Related concepts

• machine learninguses · Machine learning is a field of computational methods in which systems learn patterns or relationships from data to make predictions, decisions, or other outputs.
• threat feeduses · A threat feed is a continuously updated stream of information about cybersecurity threats, vulnerabilities, indicators, or malicious activity.
• threat intelligenceuses · Threat intelligence is analyzed, evidence-based knowledge about threats, adversaries, vulnerabilities, attack methods, and indicators that supports security decisions.
• likelihoodmeasures · Likelihood is an assessment of how probable an event or outcome is, including the occurrence of an adverse event or successful exploitation of a vulnerability.
• predictive analyticsused by · Predictive analytics is the use of data and statistical or computational methods to estimate future or otherwise unknown outcomes.
• metrickind of · A metric is a quantitative measure used to characterize or assess a property, condition, behavior, performance, or outcome.

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.