Software as a service (SaaS) services for assessing cybersecurity risk and costs