quantifying risks and threatss