A computer implemented malware protection method to protect at least a subset of computer systems in a population of network-connected computer systems, the method comprising: Identifying a plurality of clusters of computer systems in the population wherein computer systems within each cluster share at least one common characteristic; determining a distribution of a predicted final infection size for the population as a total number of systems infected by a propagation of a malware in the population, the distribution including predictions for infections originating with systems in the population, each predicted final infection size being determined by a forecasting simulation of malware propagation from an originating system in the population, the simulation being performed based on at least one malware propagation model defining at least a transmission rate of malware between systems in the population determined to be in communication with each other, and a removal rate of systems being removed from a state of infection by the malware; determining a plurality of ranges of final infection size from the distribution; determining weighted associations between the identified clusters of computer systems and the determined ranges of final infection size based on numbers of incidences, during the simulation, that a malware infection beginning at originating computer systems in each cluster results in a final infection size within each range of final infection size, wherein determining the weighted associations comprises determining the associations based on an association between each originating system in the population and a frequency of one or more final infection sizes arising from the malware propagation simulations, and the cluster membership, and determining the weightings for each determined association based on a frequency of occurrence of each final infection size within the determined ranges; deploying protective measures for one or more of the plurality of identified clusters of computer systems responsive to the weighted associations. Identifying a plurality of clusters of computer systems in the population wherein computer systems within each cluster share at least one common characteristic; determining a distribution of a predicted final infection size for the population as a total number of systems infected by a propagation of a malware in the population, the distribution including predictions for infections originating with systems in the population, each predicted final infection size being determined by a forecasting simulation of malware propagation from an originating system in the population, the simulation being performed based on at least one malware propagation model defining at least a transmission rate of malware between systems in the population determined to be in communication with each other, and a removal rate of systems being removed from a state of infection by the malware; determining a plurality of ranges of final infection size from the distribution; determining weighted associations between the identified clusters of computer systems and the determined ranges of final infection size based on numbers of incidences, during the simulation, that a malware infection beginning at originating computer systems in each cluster results in a final infection size within each range of final infection size, wherein determining the weighted associations comprises determining the associations based on an association between each originating system in the population and a frequency of one or more final infection sizes arising from the malware propagation simulations, and the cluster membership, and determining the weightings for each determined association based on a frequency of occurrence of each final infection size within the determined ranges; deploying protective measures for one or more of the plurality of identified clusters of computer systems responsive to the weighted associations.