After many years of applying ourselves as information and cyber security practitioners, we understand that securing systems, processes and data effectively, requires a risk based approach. The problem seems to be which risk model to apply. Qualitative or quantitive risk analysis? Based on threat scenarios or driven by business impact? There is no consensus among security practitioners, and therefore the most "depreciated" evidence in a security audit is the output of the security risk assessment. Our approach delivers a "security injection at the heart of a company". We analyse the means, opportunity and motives of threat actors and we combine them with real world, categorised, security vulnerabilities to come up with a detailed threat scenario. We then add to our risk formula monetary and reputational business impact values to extract the level of risk. It doesn't sound innovative, but it is effective. The level of risk is "translated" to a practical scale of priority. The threat scenario is driving the implementation of technical and organisational preventative, detective and corrective security controls and the business impact is "telling" us how to advise you in managing your company's cyber security risk.