IT Risk: From Detection to Protection