1. A method for cyber attack risk assessment, the method comprising operating at least one hardware processor for: automatically conducting a cyber space external intelligence process that comprises periodically gathering intelligence on the state of a cyber landscape which is external to an organization for which the method is performed, wherein the intelligence comprises: (a) data on threat agents that have motivation and capability to carry out a cyber attack, the data comprising at least one of: objectives of the threat agents, capabilities of the threat agents, and resources of the threat agents, and (b) data on attack methods that are used for gaining access to critical components in a system or data in the system, wherein the gaining of access is with the intent of at least one of vandalizing, stealing, and denying access to the critical components in the system or the data in the system, respectively; collecting organizational profile data from a user, wherein the organizational profile data comprises: types of computerized defensive controls employed by the organization, a maturity of each of the computerized defensive controls comprising a level of fulfillment capability for each of the computerized defensive controls with respect to a control policy of the organization, and organizational assets each pertaining to a business environment and each associated with at least one of the computerized defensive controls; computing a cyber attack risk of the organization in real time and automatically, by continuously conducting the cyber space external intelligence process and comparing the cyber space external intelligence to the organizational profile data, to compute a cyber attack risk score for each of the organizational assets; and issuing an overachievement alert when any of the levels of fulfillment of any of the computerized defensive controls exceeds the control policy of the organization, in accordance with a recommended scoring rule, to thereby prevent a waste of fulfillment effort.