A method of building a risk management model, the method including: sampling a plurality of organization networks; assessing identified security features; ranking the identified security features based on security risk; transforming ranked features into categorized factors; building logistic model to blend the categorized factors into a likelihood of breach; and transforming the logistics model from a multiplicative model to an additive model by scaling the logistics model.