Mitigating Cyber Threats: How Do You Know if You Are Doing Enough?