Estimating a System's Mean Time-to-Compromise