An application server $($the server, applications, and the information the applications process$)$ for an organization has the asset value $($AV$)$ of $$5,000,000,$ and, on average, a realized attack by a threat results in an estimated total loss of $30\%$ of the server$$s value. Prior research has suggested that the attack by the threat occurs once in every two years.