You've discovered the Big Question in cyber risk management. There is no easy answer. I've written entire papers on the subject.
The problem you have identified is to determine what data to use as a basis for a quantified likelihood calculation. The challenges you face are:
- there is not enough data in your context
- the foundation for the risk context is under constant change (technology is constantly changing, and new threats and vulnerabilities are constantly emerging, creating "perfect uncertainty" even if you had lots of data)
There are a few approaches to take:
- Use a Qualified approach based on expert opinion (and quantify a range of opinions over time for extra rigor)
- Use a sliding scale of impact and determine what quantified data you do have for each range of impact
- Use an adjacent context that does have enough data for you to use (partners, competitors, others "just like you")
- Replace "likelihood" with "ease" in your calculations
- Assume a longer time scope and assume that all events will happen eventually, which leaves you with assessing impact alone
- Combine the above approaches based on available relevant data and stakeholder requirements
As you can guess, I could go into a book's worth of exploration for each point. If you want a book, I can recommend How To Measure Anything in Cybersecurity Risk. I do not agree with everything in the book or the authors' conclusions or basis, but it is a great place to start in your thinking.
The one thing I caution you about is "false accuracy". Just because you have data and you can use a formula to generate a valid output does not mean that your conclusion is at all correct or can accurately represent likelihood. I see too many risk professionals fall into the trap of "But I made a fancy graph with lots of data points! It must be right!" All risk management is a guess and a bet against the future. And sometimes, spending too much time trying to get accurate about something that hasn't happened yet is just a waste of time.