Cybersecurity telemetry predicts future cyber loss events reliably
A Framework to Quantify the Probability of Future Cyber Loss Events
Cryptography and Security
Summary
Estimating how often cyber attacks will cause damage is tricky because of limited data. The authors developed a method called LEFSA that predicts the chance of cyber loss on individual machines using security data. These predictions are then combined across the whole company’s infrastructure to estimate overall risk. They tested this on data from 23 organizations and found their method predicts future losses well. This offers a new way for organizations to measure and manage cyber risks using real operational data.
What this means in practice
- •For security operations teams: Use machine-level cybersecurity data to predict and prioritize future cyber loss risks across an organization’s IT infrastructure.
- •For cyber risk managers: Integrate aggregated probabilistic loss predictions to inform data-driven cyber risk assessment and investment decisions.
- •For insurance underwriters: Develop data-based models to better estimate the probability of future cyber loss events for underwriting and pricing cyber insurance policies.$Commercial implications: Enables selling more accurate cyber insurance products by quantifying machine-level attack probabilities based on operational telemetry.
Authors
Siem Peters, Martin Eian
Abstract
Cybersecurity risk quantification remains challenging due to limited operational data and difficulties in quantifying Loss Event Frequency (LEF). This paper introduces the Loss Event Frequency Security Analyser (LEFSA), a probabilistic framework that reformulates LEF estimation as machine-level Cyber Loss Event (CLE) prediction combined with hierarchical infrastructure-level aggregation. LEFSA estimates calibrated machine-level CLE probabilities from operational cybersecurity telemetry and aggregates them across infrastructure layers while accounting for machine-level dependencies. This provides a foundation for scalable, explainable, and operationally applicable cyber risk estimation at the level of machines, services, business processes, and the entire organization. The framework was evaluated using proprietary Managed Detection & Response telemetry from 23 organizations using Microsoft Defender for Endpoint. XGBoost achieved the strongest predictive performance, with a mean area under the receiver operating characteristic curve of 0.90 and consistently low calibration error across evaluation periods. The results demonstrate that operational cybersecurity telemetry contains substantial predictive information for future CLE occurrence, supporting probabilistic machine-level modeling and hierarchical aggregation as a promising foundation for quantitative, data-driven cyber risk management.