Some of the most destructive cyber attacks today go unrecognized for weeks or indefinitely. Meanwhile, companies waste resources defending against other attacks that are highly unlikely. Both problems could be partially solved if companies had a better idea of what attacks to expect. Extrapolating from past attacks is not a good way to predict future ones. Fortunately, there is a better way to anticipate what new attacks are coming and how soon or how frequently we can expect them. This talk outlines a better approach to cyber threat analysis and explains how to ground cybersecurity decisions in business economics.