Understanding risk assessment in cybersecurity