How to determine cyber threat probability?

In cybersecurity, risk should be calculated with probability as a determining factor. If a threat has near zero probability of being applicable, then probability (and thus risk) should be infinitesimal.

Risk = (threat x vulnerability) x Impact / Probability (not true risk equation, but for conversation purposes)

The problem is some security folks see hypothetical threats as probable threats without any statistics to back it up, or evidence it's being exploited in the wild given a certain architecture.

"I saw …

cyber cybersecurity cyber threat threat