Which of the following are valid risk responses for threats?