Facing a (security) threat, what is the best thing to do? The overall research questions driving this study are about how security professionals assess, reason, and decide about security risks, and where their justification is founded on. The presented results are explorative, based on trying primarily to understand individual professional judgment and secondary, if possible, to explain the reasons behind this judgement. This work will not answer all the questions, it is, however, a valuable start to understand the difficult task the professionals in this domain are facing: preparing for, and thus predicting possible security threats....@en