Enhancing Surface Cyber Risk Management