1. A system for analyzing an environment to identify a security risk in a process, comprising: a processor; and a memory on which is stored machine readable instructions to cause the processor to: define components of a model of the environment, wherein the components include internal and external components and parameters of the defined components, wherein the components represent security controls to mitigate effects of the security risk, wherein the security controls include a patching process for the environment, and wherein the internal components include behavioral aspects that affect security including personnel movements and habits; translate the components into instructions for the model; calculate, based on the instructions for the model, multiple randomized instances of an outcome for the environment using multiple values for the parameters of the defined components of the model, the multiple values selected from within respective predefined ranges for the parameters, and identify a security risk in the security controls using the multiple randomized instances.