Software as a service (SAAS) services featuring software for modeling enterprise risk exposure and assessing risk mitigation options