Operationalizing Cybersecurity For Measurable Risk Reduction