A Framework to Quantify the Probability of Future Cyber Loss Events
Abstract
Cybersecurity risk quantification remains challenging due to limited operational data and difficulties in quantifying Loss Event Frequency (LEF). This paper introduces the Loss Event Frequency Security Analyser (LEFSA), a probabilistic framework that reformulates LEF estimation as machine-level Cyber Loss Event (CLE) prediction combined with hierarchical infrastructure-level aggregation. LEFSA estimates calibrated machine-level CLE probabilities from operational cybersecurity telemetry and aggregates them across infrastructure layers while accounting for machine-level dependencies. This provides a foundation for scalable, explainable, and operationally applicable cyber risk estimation at the level of machines, services, business processes, and the entire organization. The framework was evaluated using proprietary Managed Detection & Response telemetry from 23 organizations using Microsoft Defender for Endpoint. XGBoost achieved the strongest predictive performance, with a mean area under the receiver operating characteristic curve of 0.90 and consistently low calibration error across evaluation periods. The results demonstrate that operational cybersecurity telemetry contains substantial predictive information for future CLE occurrence, supporting probabilistic machine-level modeling and hierarchical aggregation as a promising foundation for quantitative, data-driven cyber risk management.
Related
- A Unified Framework for Probability Estimation of Data-Dependent Events
- On Over-Conservatism Under Low-Probability Extreme Events: A KL-Regularized Wasserstein Distributionally Robust Planning Method
- An event is a set, not a number: building the algebra of events before the probability measure in a school progression
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- A Cyber Physical Framework for Intelligent Fault Detection and Predictive Maintenance in Digital Power Grids
BibTeX
@misc{peters2026framework,
title = {{A Framework to Quantify the Probability of Future Cyber Loss Events}},
author = {Siem Peters and Martin Eian},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2609.21717},
eprint = {2609.21717},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.21717},
}
RIS
TY - UNPB
TI - A Framework to Quantify the Probability of Future Cyber Loss Events
AU - Siem Peters
AU - Martin Eian
PY - 2026
DA - 2026/10/02
PB - arXiv
DO - 10.48550/arxiv.2609.21717
UR - https://arxiv.org/abs/2609.21717
AB - Cybersecurity risk quantification remains challenging due to limited operational data and difficulties in quantifying Loss Event Frequency (LEF). This paper introduces the Loss Event Frequency Security Analyser (LEFSA), a probabilistic framework that reformulates LEF estimation as machine-level Cyber Loss Event (CLE) prediction combined with hierarchical infrastructure-level aggregation. LEFSA estimates calibrated machine-level CLE probabilities from operational cybersecurity telemetry and aggregates them across infrastructure layers while accounting for machine-level dependencies. This provides a foundation for scalable, explainable, and operationally applicable cyber risk estimation at the level of machines, services, business processes, and the entire organization. The framework was evaluated using proprietary Managed Detection & Response telemetry from 23 organizations using Microsoft Defender for Endpoint. XGBoost achieved the strongest predictive performance, with a mean area under the receiver operating characteristic curve of 0.90 and consistently low calibration error across evaluation periods. The results demonstrate that operational cybersecurity telemetry contains substantial predictive information for future CLE occurrence, supporting probabilistic machine-level modeling and hierarchical aggregation as a promising foundation for quantitative, data-driven cyber risk management.
ER -