What does the sum of the risks presented by an application represent for that application?