Managing cybersecurity risk