1. A device, comprising: one or more processors, at least partially implemented in hardware, to: identify a set of features associated with an unknown object; determine a set of predicted threat scores associated with the unknown object, a predicted threat score, of the set of predicted threat scores, corresponding to a security function of a set of security functions; determine, based on the set of predicted threat scores and a set of costs corresponding to the set of security functions, a set of predicted efficiencies, a predicted efficiency, of the set of predicted efficiencies, corresponding to a security function of the set of security functions; identify, based on the set of predicted efficiencies, a particular security function, of the set of security functions, for execution on the unknown object; cause the particular security function to be executed on the unknown object in order to determine a threat score associated with the unknown object; and determine, based on the threat score, whether another security function, of the set of security functions, is to be executed on the unknown object.