Uncertainty in Security Analysis