Our framework enables cybersecurity experts to identify which defenses are necessary—and how to prioritize them