Statistics turns security data into evidence for decisions. By examining patterns, relationships, and changes over time, teams can spot unusual activity, assess risk, and judge whether defenses are improving. A useful analysis starts with a security question—such as whether failed logins are rising—and ends with an action, not just a number. section 2.3 section 4.0
Choose a method that fits the decision:
- Use trend analysis or time series forecasting to track changing attack activity and anticipate future demand on defenses. section 2.3 section 11.10
- Use correlation analysis to look for relationships, such as a link between login times and failed attempts, or between downtime and attacks. section 2.3 section 11.1.1
- Use benchmarks and statistical tests to compare security metrics before and after a change, such as a new intrusion detection system. section 11.1.1
- Use probability distributions to express possible outcomes; a chart of monthly exploit counts can help prioritize resources for more likely scenarios. section 11.9.1
Turn a traffic spike into an investigable alert
Suppose a team wants to detect unusual data throughput. It collects available historical logs—perhaps six months—to establish a baseline, then examines weekly percentiles, averages, and standard deviations. A threshold such as the mean plus two standard deviations can flag outliers for investigation. The threshold is a starting point for a monitored alert, not proof of a threat: the team should measure results and adjust its approach to limit false positives. section 8.4.1
Statistical results need organizational context. An increasing phishing trend may justify stronger email defenses; an estimated exploit frequency may affect staffing and vulnerability priorities. Quantitative risk assessment uses numerical data and statistical models to estimate likelihood and impact, while predictive analytics uses historical data alongside threat intelligence and current vulnerabilities. Present the finding, its relevance to a security goal, and the recommended decision together. section 11.1.1 section 6.3.1 section 10.1 section 4.0
