Stack Risk. We need to know how much CPU power entities have at their dosposal.
That's actually a great idea and almost impossible to make reliable.
We could measure "stack risk" for registered, 100% above board companies with their own data centers and employees, but we can't really measure the risk of some guy in eastern europe with access to a 1 billion node, globally distributed and illegal obtained, Android bot net.