A method includes predicting, before a first period of time, a plurality of predicted event metric values and value ranges corresponding to a first plurality of events to occur over the first period of time based on a plurality of prediction models, determining an actual event metric value of the first plurality of events, and determining a plurality of model range multi-partition error (MRME) values indicative of an accuracy, precision, and relative range of the forecasting models based on the actual event metric values, value ranges, and the predicted event metric values. The method includes selecting one of the forecasting models based on the MRME values, determining a cyber security control limit based on a predicted event metric value or predicted event metric range by the selected forecasting model, and outputting an alert based on an actual event metric value being outside of the cyber security control limit.