Our knowledge base of attacks is always not enough for developing and maintaining information systems. An information system, which is developed and maintained according to an insufficient knowledge base of attacks, has no capability of defending against new attacks from the complicated environment. To mitigate this circumstance, we should continuously predict new attacks and add them into the knowledge base of attacks such that by enriching the knowledge base of attacks, information systems can be developed and maintained more countermeasures to confront those new attacks. However, there is no methodology proposed for predicting new attacks. This paper presents an analysis and discussion for predicting new attacks and shows the challenges issues in predicting new attacks. The paper also proposes a reasoning method for predicting new threats.