An organization's security posture is the security status of all its networks, data, people, and
systems; the resources it employs to protect them; and its ability to defend against attacks
and quickly recover from them, patching vulnerabilities can minimize the investment cost but
only a small reduction in the system risk. Therefore, efficient security assessment methods
are needed that are not model or metric oriented, as well as an equivalent accuracy with
respect to evaluating all possible attack scenarios.