A device for identifying one or more security functions, used to determine a current threat score associated with an unknown object, based on determining a set of predicted efficiencies for executing the one or more security functions on the unknown object, wherein when a security function is executed on the unknown object, the security function provides a determination of whether the unknown object is a malicious object, the device comprising: one or more processors to: receive the unknown object; identify a set of features associated with the unknown object, wherein the set of features describes the unknown object; determine, based on inputting the set of features into a threat prediction model, a set of predicted threat scores, the threat prediction model being associated with a set of security functions, wherein each predicted threat score corresponds to a respective one of the security functions; determine, based on the set of predicted threat scores, a set of predicted utility values, wherein each predicted utility value corresponds to a respective one of the security functions, wherein a utility value includes information indicating how useful the corresponding security function is in determining whether an object is malicious; determine a set of costs corresponding to the set of security functions, wherein each cost corresponds to a respective one of the security functions, wherein a cost includes information identifying an amount of resources associated with executing the security function on an unknown object; determine a set of predicted efficiencies, associated with the set of security functions, based on the set of predicted utility values and the set of costs, wherein each efficiency corresponds to a respective one of the security functions; identify, based on the set of predicted efficiencies, a particular security function, of the set of security functions, that is to be executed on the unknown object; cause the particular security function to be executed on the unknown object in order to determine a current threat score associated with the unknown object; and determine, based on the current threat score, whether another security function, of the set of security functions, is to be executed on the unknown object. receive the unknown object; identify a set of features associated with the unknown object, wherein the set of features describes the unknown object; determine, based on inputting the set of features into a threat prediction model, a set of predicted threat scores, the threat prediction model being associated with a set of security functions, wherein each predicted threat score corresponds to a respective one of the security functions; determine, based on the set of predicted threat scores, a set of predicted utility values, wherein each predicted utility value corresponds to a respective one of the security functions, wherein a utility value includes information indicating how useful the corresponding security function is in determining whether an object is malicious; determine a set of costs corresponding to the set of security functions, wherein each cost corresponds to a respective one of the security functions, wherein a cost includes information identifying an amount of resources associated with executing the security function on an unknown object; determine a set of predicted efficiencies, associated with the set of security functions, based on the set of predicted utility values and the set of costs, wherein each efficiency corresponds to a respective one of the security functions; identify, based on the set of predicted efficiencies, a particular security function, of the set of security functions, that is to be executed on the unknown object; cause the particular security function to be executed on the unknown object in order to determine a current threat score associated with the unknown object; and determine, based on the current threat score, whether another security function, of the set of security functions, is to be executed on the unknown object.