Business-aligned cyber risk assessment