6 Truths of Cyber Risk Quantification