Probably the people having done the most work on this are cybersecurity firms, they looked at assessing the true nature of their online adversaires. Some seem quite satisfied with their models. But they have they own metrics, which do not translate well into other areas.