Abstract: Receiving configuration settings (CSs) from a resource using an API; determining a resource risk score (RERS), a first tactic risk score (TARS), a first plurality of technique risk scores (TERSs), a second TARS, and a second TERSs, wherein the RERS is based on the first TARS and the second TARS, wherein the first TARS is based on the first TERSs, wherein the second TARS is based on the second TERSs, wherein each of the first TERSs is based on a subset of a set of policy scores (SPS), wherein each of the second TERSs is based on a subset of the SPS, and wherein each of the SPS is based on compliance of the CSs with a setting; and selecting a most-important technique (MIT) based on the first TARS, the second TARS, and one of the first TERSs and the second TERSs, and remediating a CS corresponding to the MIT.