Risk in cyber systems