Risk ranking taxonomy