We forecast hurricanes, credit defaults, insurance losses, disease outbreaks, and adversary behavior. Yet cybersecurity still spends much of its time studying attacks that have already happened. Can we use that same historical evidence to anticipate what comes next?

Husband-and-wife research team Tim and Suzanne O’Neil set out to test whether cyber threat forecasting could be more than hype. They developed a weighted methodology using multiple years of publicly available threat, incident, and financial-loss data, then backtested it across four persistent threats: ransomware, phishing, business email compromise, and stolen credentials.

In this tag-team presentation, Tim will explain how the methodology evaluates threat frequency, financial impact, historical patterns, industry exposure, and defensive controls. Suzanne will challenge the findings from an executive perspective: Are the forecasts understandable? Are they actionable? And are they reliable enough to influence security priorities?

They will share where the forecasts performed well, where they missed, and how inconsistent reporting, changing attacker behavior, limited data, and black-swan events complicate even disciplined predictions. Attendees will learn how confidence can be expressed without pretending certainty—and how forecasts can be translated into defensible security decisions.

No crystal balls. No “AI-powered” hand-waving. Just the methodology, the evidence, the misses, and an uncomfortable question for the industry: If cyber threats can be forecast with measurable confidence, why are we still defending primarily through the rearview mirror?

Preferred duration: 50 minutes, followed by 10 minutes of Q&A.
Format: In-person, tag-team presentation by Tim and Suzanne O’Neil.
Target audience: Security practitioners, researchers, threat-intelligence professionals, security architects, consultants, CISOs, risk leaders, and technically curious executives. The session is intended for an intermediate audience, but no knowledge of statistics or machine learning is required.
Prior delivery: This specific presentation has not previously been delivered at a public conference. CactusCon would be its first public conference presentation.
Technical requirements: Standard projector or large display with HDMI connectivity, presentation computer compatibility, confidence monitor if available, and two wireless microphones. Internet access is not required. The presentation will not include a live product demonstration.
This is an original research presentation—not a vendor pitch. It will not include pricing, sales solicitations, or a commercial call to action. The presenters will disclose their affiliation with AigisPoint Predictive Intelligence for transparency while focusing entirely on the methodology, evidence, results, failures, and practical lessons.
Proposed outline:
1. Why is cybersecurity still reactive? — 5 minutes
Comparison with forecasting in weather, lending, insurance, actuarial analysis, and military planning. Definition of prediction, forecasting, probability, and certainty.
2. The hypothesis and rules of the experiment — 5 minutes
The four threat categories examined: ransomware, phishing, business email compromise, and stolen credentials. How the research attempted to prevent hindsight from being mistaken for prediction.
3. Constructing the methodology — 10 minutes
Combining multiple years of publicly available threat, incident, and financial-loss data. Weighting frequency, severity, historical patterns, industry exposure, defensive controls, and confidence.
4. Backtesting the forecasts — 10 minutes
Comparing selected historical forecasts with subsequently observed outcomes. Explaining how error and accuracy were measured—and why directional accuracy, percentage error, and confidence are not interchangeable.
5. Where the methodology worked—and where it broke — 8 minutes
Successful and unsuccessful results, inconsistent reporting, missing incidents, classification changes, attacker adaptation, distorted trends, overfitting, and black-swan events.
6. The executive challenge — 7 minutes
Suzanne challenges whether the findings are understandable, actionable, and responsible enough to influence real security decisions.
7. Turning forecasts into defenses — 5 minutes
Using forecasts to inform control prioritization, scenario planning, security assessments, and risk discussions without replacing professional judgment.
Attendees will leave able to distinguish evidence-based forecasting from prediction theater, evaluate the confidence and limitations of a cyber forecast, and translate probabilistic findings into defensible security priorities.