Forecasting Malware Risk to Prevent Incidents

This document is a research report from TrendAI™ that addresses a significant gap in security operations regarding malware risk management. It presents a method for assessing the probability of a malware outbreak at specific endpoints within a 30-day timeframe, utilizing observed user and system behaviors as leading indicators of risk. The study evaluates six malware classes: coinminer, hacktool, PUA, ransomware, trojan, and virus, providing distinct probabilities for each class based on behavioral patterns. The model was trained on telemetry data from over 12 million Windows endpoints across 200 countries and analyzed various behavioral indicators, including web activity and software execution. The findings indicate that different malware classes correlate with specific device usage patterns, allowing security teams to prioritize controls and monitoring on endpoints most likely to be compromised. The report emphasizes the importance of operationalizing risk management within existing platforms to enhance organizational resilience against potential malware threats.