A startup's security team is prioritizing which risks to address first. For a potential ransomware attack, they estimate a fairly high chance the attack will occur in the next year, and they calculate that if it did, the resulting downtime and recovery costs would be severe enough to threaten the company's survival. Which two factors are the team combining to evaluate this risk?