The idea of basing cybersecurity program actions on analyzing the various risks faced by an organization has been around for decades. Over time it has evolved and matured in its structure and approach. Analytical methods have emerged over time to define and structure the various elements and interactions that are germane. What remains as basic questions though is how to choose which method suits a given context and how to overcome the natural resistance to accepting results from this process that is often criticized for its perceived uncertainty when used to drive cybersecurity mitigation strategy.