Scenario-based risk assessment