This is a heuristic score for prioritization and discussion, not a statistical probability. Weights are informed by general, widely-corroborated patterns in threat reporting (e.g. small and mid-sized organizations being disproportionately targeted, and security controls measurably reducing incident likelihood) — not a single validated dataset. Use it as a conversation starter, not a substitute for a formal risk assessment.