Abstract: Systems and computer-implemented methods for determining overall risk modification indicative of an amount by which an overall risk associated with a plurality of threats is modified by implementing a combination of security controls are disclosed. A computer-implemented method includes receiving a plurality of individual risk modification amounts. Each individual risk modification amount corresponds to a corresponding security control of the combination of security controls and a corresponding threat of the plurality of threats. Each individual risk modification amount of the plurality of individual risk modification amounts is indicative of an amount by which a risk associated with the corresponding threat is modified by implementing the corresponding security control. The method further includes determining, automatically by a computer, the overall risk modification amount based on the plurality of individual risk modification amounts.