Quantifying security implications