Football cybersecurity threat severity prediction using multi-head transformer-based deep learning models

Why your favorite club’s data is a tempting target

Modern football is as much about data as it is about goals. Clubs now run on digital systems that manage everything from online ticket sales and streaming to player analytics and global fan apps. That convenience comes with a hidden risk: cybercriminals see football’s money, fame, and vast databases as an opportunity. This paper explores how a new kind of artificial intelligence can help clubs predict how severe a cyber incident might be, so they know which threats to tackle first and how to protect the game’s digital backstage.

The digital side of the beautiful game

Professional clubs and major events like the World Cup now rely on sprawling online services: visa and travel platforms, stadium access systems, live broadcasts, fan databases, and financial tools. Each connection is a potential doorway for attackers. Recent years have seen incidents ranging from ransomware that locks critical systems, to data breaches exposing fan and player information, to attacks aimed at disrupting broadcasts or ticketing. Smaller and less wealthy clubs are often hit hardest, because even a single attack can swallow a large share of their annual revenue and damage their reputation with fans and sponsors.

Why today’s tools are not enough

Most existing risk tools in sports still use simple statistical formulas or classic machine learning to guess how bad an incident might be. But real-world security data are messy: they mix numbers and categories, include many intertwined factors, and change as attackers adopt new tricks. Traditional models often treat each factor in isolation or assume relationships are straight lines, so they can miss subtle combinations such as a medium-sized club with modest security spending being hit by a particular kind of attack on a specific system. As a result, severity estimates can be unreliable, making it harder for clubs to decide where to invest limited security resources.

A new playbook: transformers for cyber risk

The authors propose adapting a powerful AI design, originally developed for understanding language, to football cybersecurity. Their model, a multi-head transformer, takes in a rich table of information for each incident: league level, club revenue tier, staff size, type of attack, which system was targeted, financial loss, operational disruption, reputational harm, response time, and how much the club spends on security. An expert-defined severity score blends these impacts into a single continuous value. Inside the model, categorical details (such as league or attack type) are turned into dense numerical representations and passed through attention layers that learn which features matter most together. Numerical features, like financial loss and response time, are processed in parallel and then fused with the categorical signals before producing a final severity prediction.

Testing the model on a football-focused dataset

Because detailed incident data from clubs are sensitive, the researchers built a synthetic but realistic dataset of 60,003 cyber events reflecting known patterns from public reports and industry standards. The data capture how often different attacks strike each league, how much money they drain, which systems—such as ticketing, fan apps, email, or financial platforms—are hit, and how those factors affect clubs with different budgets and sizes. The transformer’s performance was compared with common techniques such as linear regression, support vector machines, random forests, XGBoost, and gradient boosting. Using standard accuracy measures, the new model closely matched or outperformed these strong baselines, while also proving stable across different data splits and random seeds. Importantly, explainability tools showed that no single variable drives the predictions; instead, combinations of operational impact, reputational damage, attack type, and targeted system work together to shape the severity score.

What this means for clubs and fans

For clubs, an accurate and interpretable severity forecast is like having a smart triage nurse for cyber incidents. When a new alert appears, the system can estimate how damaging it is likely to be, helping security teams focus first on threats that might halt ticket sales, compromise fan data, or disrupt match-day operations. League organizers can also use aggregated results to see which competitions or types of clubs are most exposed and design tailored support programs. While the model still depends on good data and struggles with the rarest, most extreme events, the study shows that advanced AI can turn complex digital signals into clear, actionable risk scores. In plain terms, it offers football a new defensive line—not on the pitch, but in the networks and systems that keep the sport running.

Citation: Hassan, B.M., Algarni, F., Alshamrani, R. et al. Football cybersecurity threat severity prediction using multi-head transformer-based deep learning models. Sci Rep 16, 12187 (2026). https://doi.org/10.1038/s41598-026-44399-3

Keywords: football cybersecurity, cyber threat severity, sports analytics, deep learning transformers, risk assessment