...configuration of IT assets, and critically grading the level of patch protection afforded to business-critical and supportresources. However, until enterprises are able to apply attack simulations and risk analytics to this integrated model...
http://www.computerweekly.com/Articles/2004/03/12/201002/letters.htm