Aspects of the invention include a computer-implemented method, including performing simulations of a form of cyber-attack based on different input parameters to determine a respective time to perform each cyber-attack on a plurality of features of a sensor-based device. Additionally, performing simulations of a plurality of mitigating processes for each cyber-attack based on different input parameters to determine a respective time to perform each mitigating process. An associated risk level of each cyber-attack is determined based at least in part on the simulations. A mitigation process is selected based at least in part on the associated risk levels.