Abstract: Methods, systems and apparatus, including computer programs encoded on a computer storage medium, for assessing and managing cyber threats. In some implementations, data specifying relationships between I.T. system infrastructures, system categories, operational processes, computer-based threats and mitigation actions is received. A plurality of simulations are performed using a Monte Carlo method, with each simulation involving propagating data through stochastic modeling for a given time window having a beginning and end. Outcomes of the plurality of simulations that include mitigating actions representing the threat mitigation measures of the organization, for a given time window, determine a measure of impact of cyber threats to the organization. The determined measure is provided for output to a user.