If you cannot measure it, you cannot manage it: three essays on cybersecurity risk assessment