Predictive analytics

As explained in Data-Driven Cybersecurity

Predictive modeling is the construction of statistical or computational models that estimate likely future or unknown outcomes from data.

Predictive analytics uses statistical algorithms, machine learning, and data analysis to identify patterns and estimate future events. In cybersecurity, models combine historical incidents, threat intelligence, and current vulnerabilities to forecast potential security incidents. The aim is to give teams time to act before a threat escalates, rather than measure it only afterward. section 10.1 section 1.3

Turn a forecast into a decision:

• Use a risk exposure index (REI) to summarize current risk from vulnerabilities, exploitation likelihood, and business effect; use a predictive threat index (PTI) to estimate future incident probability from attack history, threat intelligence, and monitoring. section 10.2
• Prioritize likely attack vectors and high-risk vulnerabilities, then pair monitoring with preventive controls and policies. A forecast alone does not prevent an incident. section 10.2 section 1.3

A measurable risk-management goal

A financial services company facing malware attacks starts with an REI of 80%, a PTI indicating a 60% likelihood of a malware attack within six months, 50 malware incidents per month, and a 12-hour response time. It targets an REI below 40%, a PTI below 20%, 15 monthly incidents, and a four-hour response time. Teams prioritize patching vulnerabilities likely to be targeted and monitor network traffic and user behavior; after six months, the REI falls to 35%. The useful report compares these measures with the targets, not just the number of alerts generated. section 10.2.3

An implementation can bring incident records and threat intelligence into Elastic Stack for pattern analysis and dashboards, while Wazuh monitors activity and integrates with predictive models. Analysts still need to configure data pipelines, queries, alerts, and thresholds for the organization’s risk tolerance. Reassess forecasts as threats and vulnerabilities change. section 10.2.5 section 10.2

Figure 10.1 The left side shows risk exposure and predictive analytics before implementing improvements. The right side shows the situation afterward.

Compare the before-and-after dashboard to see whether predictive work accompanies improvement in risk and response measures. section 10.2.3

How Data-Driven Cybersecurity covers it

How deep it goes

Defines the approach and works through risk metrics and a dashboard exercise, but defers a deep dive into statistics and AI.

Examples

Uses a financial-services dashboard with malware likelihood, incident volume, response time, and before-and-after risk scores.

What it assumes

Introduces the method without requiring advanced statistics, while implementation calls for suitable tools and cybersecurity expertise.

What you can do after

Apply it via risk and threat indexes to set targets, prioritize defenses, and assess measured improvement.

How it connects

Links machine learning, threat intelligence, anomaly detection, risk exposure, and preventive controls.

liveBookmanning.com

Read Data-Driven Cybersecurity on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  The Art of AI Product DevelopmentThe analysis of data with statistical or machine-learning methods to estimate future or unknown outcomes.
• 

  liveBookmanning.com
  Effective Data AnalysisPredictive modeling is the construction and use of models to generate predictions for new or unknown observations.

Compare how 3 books explain predictive analytics →

Related concepts

• labeled datauses · Labeled data is a set of examples or observations paired with target values, categories, or other task-relevant annotations.
• linear regressionuses · Linear regression is a statistical modeling method that estimates a continuous response as a linear combination of predictor variables and fitted coefficients.
• threat detectionused by · Threat detection is the identification of activity or conditions that may indicate a security threat, attack, or compromise.
• machine learninguses · Machine learning is a field of computational methods in which systems learn patterns or relationships from data to make predictions, decisions, or other outputs.
• historical datauses · Historical data is information recorded about past events, observations, outcomes, behaviors, or states and retained for later access or analysis.

This explainer was generated by Manning's knowledge graph from the text of Data-Driven Cybersecurity. The section links point to the parts of the book it draws on.