Abstract: Providing a risk analysis report for an undesired event may include identifying an attack type resulting in the undesired event and at least one requirement for a successful attack. Providing the report may further include obtaining protection data associated with protection measures that affect the requirements for a successful attack, performing each simulation in a plurality of Monte Carlo simulations for the attack type a number N of times based on the undesired event, the attack type, and the protection data, and in response to determining that the N performances of a simulation indicate at least one wildcard, performing it an additional N times. Providing the report may also include identifying a vulnerability of the protection measures to the attack type based on the performances of the plurality of Monte Carlo simulations and generating the risk analysis report for the undesired event based on the attack type and the vulnerability.