Security metric based risk assessment.