1. A method for assessing a risk to a computer network, comprising: identifying a human factor related to a risk to the computer network; determining a risk level using the human factor; and remediating at least a portion of the computer network based on the risk level.