The nascent cybersecurity industry has plenty of useful models—models for prioritizing vulnerabilities and models for catching anomalies. These models are all wrong in one similar way: They are all global models trained on centralized data and distributed to enterprises worldwide.
Simple ones, like the Common Vulnerability Scoring System (CVSS) are designed by committees with little outcome data driving the choice of variables. More sophisticated models, like the Exploit Prediction Scoring System (EPSS), use data centrally sourced from contributing firms. (Forbes)