In risk management within projects, probability is used as a way to understand how likely risks are to happen in the future. This is obviously a well-established area.
Presumably there is nothing limiting us from applying the concept of probability to issues [risks that have materialised] that could have happened in the past (where uncertainty exists in whether the issue did or did not occur).
As an related example, I may believe that our organisation has been subject to a cyber attack within the last week. However, we haven't observed this attack happening directly and so we have to build up a picture of whether or not it happened based on information we uncover. It seems appropriate to me that I can take and apply the concept of probability and therefore assess issues in the same way I assess risks.
Does this logic seems permissible? Is this how people think about issues within their risk management?