Evidence-Based Threat Analysis