Cyber risk assessment is still more of an art than a science. It’s time that changed, and we swapped colour-coded heat maps for value at risk.