Discuss the difficulty in estimating the probability of a threat or attack occurring. What are some methods that can be used to make these estimates? Answers may include insurance underwriting tables, counting historical occurrences of various types of losses, interviewing people familiar with emerging trends in cyber-security, etc.