21. The method of claim 20 , wherein the aggregate risk metric is one of: a sum of the respective risk metrics, a mean of the respective risk metrics, a maximum of the respective risk metrics, a minimum of the respective risk metrics, or a mode of the respective risk metrics.
20. The method of claim 19 , further comprising: determining a respective risk metric for the asset and each of the plurality of vulnerabilities; and determining an aggregate risk metric for the asset from the respective risk metrics for the asset and each of the plurality of vulnerabilities.