Agent-Based Modelling for Security Risk Assessment