You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names. 

I think you missed the competing risk, that of increased operator error by not using predictable host names.  

This is how I would asses those conflicting measures:

---

# Use unpredictable host names

**Benefit(s)**

An attacker will need to spend (significant) more effort in determining the layout of your network and to identify the most profitable targets for a penetration attempt.

**Risks**

Operator error. Users and administrators may have difficulty identifying systems  and their correct roles e.g. confusing test and production systems. 

- Probability: **high**
- Impact: **high** 

**Rationale**: Most humans have terrible memories where "random" data is concerned --> high probability.   

Also there are usually very few barriers that prevent trusted users and administrators from making high impact mistakes  --> high impact. 


 ---

# Use predictable host names


**Benefit(s)**

Reduced operator error rates, ease of management and automation.  

**Risks**

Attackers will  also have an easier time determining the layout of your network and to identify the most profitable targets for a penetration attempt. 

- Probability: **medium**
- Impact: **low** 

**Rationale**: Not every naming convention is immediately intuitive to a black-hat  attacker --> medium probability.  

Also using hostnames to predict a network layout is only a shortcut, but doesn't provide information that an attacker wouldn't be able to learn through other means.  And  knowledge of the role of a server as disclosed by a hostname does not automatically make it more vulnerable (only more or less valuable). --> low impact.