Which of the following is a fundamental principle of quantitative risk assessment as it applies to Certified Cyber Professional?