Abstract: A cyber security risk model mitigates cyber security risks for an asset environment (including a virtual asset) by utilizing a functions, connections and identities to determine a cyber security risk index (CSRI). An asset environment may comprise one or more functions where each function has one or more connections associated with any one or more of the functions and one or more identities associated with the virtual asset. A CSRI may be determined for each function based on the cyber security risk model that takes into account the cyber security risks or attributes associated with each function, connection and identity associated with the virtual environment or virtual asset. The asset environment may be adjusted, reconfigured, or otherwise altered based on the CSRI for any given function or for an overall CSRI. An alert may also be triggered based, at least in part, on a determined CSRI.