forecasts

[FORECAST ] Iran’s Cyber Window Is Still Open—But the Qualification Clock Is Now the Hardest Adversary (Updated 2026-05-05!)

Iran cyber isn’t quiet. The problem is the scoreboard. Every recycled leak and nuisance outage wants to become “critical infrastructure impact” before the evidence has its pants on.

Wes

Wes

— 6 min read
Share
[FORECAST ] Iran’s Cyber Window Is Still Open—But the Qualification Clock Is Now the Hardest Adversary (Updated 2026-05-05!)
When the campaign claim is loud, but the impact evidence is still buffering.

This is the 5th installment of our What's Iran gonna do next series of forecasts:

TL;DR

  • Current forecast: 43% that a qualifying Iran-linked incident is publicly evidenced by 2026-05-20.

  • Read that as: low-40s, not a precise point estimate. The threat is real, but the evidence bar is still unmet.

  • Why not higher: the best current public candidate still lacks hard numbers on outage duration, customer impact, or affected asset counts.

  • Why not lower: CISA already confirmed Iran-affiliated, in-window PLC disruption across multiple U.S. sectors, including operational disruption and financial loss.

  • Main thing to watch: a victim, regulator, or agency adding quantified impact or naming a clearly new access path or toolchain.

AlphaHunt

Stop doomscrolling, start decisioning. We chewed through the muck so your team doesn’t have to. → Subscribe!

Like this? Forward this to a friend!

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Forecast Card

  • Question: Will Iran-linked cyber operators (state units and aligned proxy/hacktivist ecosystem) conduct at least one novel, materially disruptive or data-compromising cyberattack against U.S. or Israeli organizations during the current resolution window ending 2026-05-20, attributable with high confidence by credible authorities?

  • Resolution Criteria: Yes if a credibly confirmed Iran-linked incident against a U.S. or Israeli organization by 2026-05-20 clears all three gates: high-confidence attribution, material impact above threshold, and at least one novel dimension. No if activity is only DDoS/defacement, recycled leaks, weakly evidenced claims, or below-threshold impact. Full threshold language is in the audit JSON.

  • Horizon: 2026-05-20T23:59:00-04:00

  • Probability (Now): 43% | Log-odds: -0.2819

  • Confidence in Inputs: Medium

  • Base Rate: 30% from a roughly one-in-three analog reference class, not an exact same-gate historical rate.

Read more