1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: determine whether a particular asset is vulnerable to a particular threat; determine whether the particular asset is protected from the particular threat by one or more countermeasures in a set of countermeasures including at least one network-based countermeasure and at least one agent-based countermeasure, wherein determining whether the particular asset is protected from the particular threat includes determining a likelihood that one or more of the network-based countermeasures protects the particular asset and determining a likelihood that one or more of the agent-based countermeasures protects the particular asset; and determine a risk metric for the particular asset for the particular threat according to whether the particular asset is vulnerable to the particular threat and whether the particular asset is protected by one or more of the countermeasures for the particular threat.