I'm currently interested in mining bug bounty disclosed reports and bounty hunter profiles to come up with archetypes of both defending organizations and attacking groups/individuals.

Long term, I would like to see attack+defense hacking incidents run as computer simulations (in a framework like OpenAI's "gym"), but I suspect the public (outside of intelligence and a few select private cybersecurity companies) doesn't have enough information to build this type of model yet. Developing sensors and converting raw data into information to be able to build those models is a prerequisite.