1. A device, comprising: one or more processors to: receive an unknown object; identify a set of features associated with the unknown object; determine, based on inputting the set of features into a threat prediction model, a set of predicted threat scores, the threat prediction model being associated with a set of security functions, and a predicted threat score, of the set of predicted threat scores, corresponding to a security function of the set of security functions; determine, based on the set of predicted threat scores, a set of predicted utility values, a predicted utility value, of the set of predicted utility values, corresponding to a security function of the set of security functions; determine a set of costs corresponding to the set of security functions; determine a set of predicted efficiencies, associated with the set of security functions, based on the set of predicted utility values and the set of costs; identify, based on the set of predicted efficiencies, a particular security function, of the set of security functions, that is to be executed on the unknown object; cause the particular security function to be executed on the unknown object in order to determine a current threat score associated with the unknown object; and determine, based on the current threat score, whether another security function, of the set of security functions, is to be executed on the unknown object.