1. A method comprising: selecting, from a repository, a set of collections of forecasted feature vectors for a future time window after a present time, a cyber-attack being in progress in a data processing environment at the present time, a collection in the set having feature vectors that are indicative of an event related to the cyber-attack in a region of the environment at a discrete time; classifying the events corresponding to the collections in the set into a class of cyber-attack; determining, from a mapping between a set of phases of the cyber-attack and a set of classes, a phase that corresponds to the class; and predicting the determined phase as likely to occur during the future time window in the region.