Describir: Security as a Game – Decisions from Incomplete Models