Adaptive Security and Cyber Assurance for Risk-Based Decision Making