The chapter further highlights and explains some of the special considerations that need to be taken into account for risks associated with cyberattacks, and addresses in more detail some of the essential differences between analyzing cyber risks and risks from other intentional acts, versus risks associated with accidents and other random occurrences. Accordingly, it recommends the use of performance measures that are based on the time it takes for an adversary to find a way to breach the system and inflict harm without being detected. Based on lessons learned from previously perpetrated large-scale cyberattacks, such as the SolarWinds attack, it advocates for red teams consisting of both government and private cybersecurity experts to take a war-game approach for uncovering the fastest ways of penetrating existing distributed cyber networks without detection. It also describes a process for developing probability distributions for such performance measures using results obtained from the red teams.