When companies detect a possible threat or vulnerability, answering the simple questions of what the impact of the vulnerability may be and how should a company mitigate the threat is not so easy in today's complex networks.