Risk mitigation decisions for it security - Meru Sandbox