Data-driven risk quantification for proactive security