Ever since I learnt how AI raids work in player cities (2005), I've felt that there's something wrong with that system - aliens only come to city when you disable cloak or when you fill CC at least to 50% (random attack chance increases). I think it should work instead like this:
City Controller point system
City Controller CRU bar will be changed from 0-100% to 0-100 000 points system. Each CRU adds the ql amount of points to the bar ie. 100% CRU adds 100 points to CC. This means that you need 1000 x 100% CRUs to fully fill the City Controller. By each day the CC uses 1000 points of CRU to keep the city cloak active ie. the CRUs work as "fuel". So full CC will last for about 3.3 months (100 days).
Alien threat level bar and random attacks
Now there will be 2nd bar in CC that shows the alien threat level on 0-100% scale. Aliens want to take out the player cities and for this purpose there are random attacks, so by each hour the threat level is increased by 1% which means that in 100hours (~4.25 days) random alien attack will occur. If city has no defenders when random attack occurs, the Hacker'Uris will do 10 000 points worth of damage to City Controller before they are called back to mothership ie. 10x more damage than city uses CRUs as "fuel" per day so it's important that random city attack is deflected by killing the aliens. First random attack reduces threat level to 50% (there's so many player cities for aliens to attack...), second to 75% and third to 90% and to 90% all random attacks from then on (if there's no defenders, wouldn't you increase the rate at which you attack the same target? That's what this system will do), which also means that city will get random attack every 10 hours.
Starting city raids
To reduce threat level back to 0% the city cloak system needs to be "rebooted" (ie. disabled) which takes an hour. During this time aliens will attack the city because city cloak is disabled ie. this is the same system as currently is for city alien raids. During raid the Hacker'Uris can only do max 100 points of damage to City Controller (it's in secure, controlled reboot sequence). The cloak gets re-enabled automatcially after the 1 hour downtime and can be disabled again after 1h it was re-enabled (like it's now). One alien city raid per 4 days is enough to keep the random attacks from happening.
Alien orbital bombardments and destroyed buildings
CRU amount in City Controller does not affect how often the random attacks will occur but if city had full City Controller (100 000 points) and gets 10 random attacks so that the CC's "fuel" is reduced to 0 your organization's city cloak will be disabled and the city will be open for alien orbital bombardments/strikes - these bombardments will have a chance to destroy city buildings. They would destroy the buildings in certain order (less valuable first) and if the last building, ie. HQ is destroyed, your org will loose the city. Note that since CRUs no longer increase the random attack chance, you can safely dump all your CRUs to City Controller (or sell to others who need them).
CRU demand and availability
Because CRU demand would increase a lot, perhaps the CRU missions should be adjusted (yes, there's such missions, for clans the npc is at Tir whompa) and give QL 100 CRU as mission reward. Some new CRUs could be added to Trader/Fixer shops (prices adjusted too) ie. fixer shop could sell QL 50-75 CRUs and Trader shop QL 65-85 CRUs. Since CRUs aren't needed anymore for starting the raid, those shops could sell them. Intrusion Countermeasure Electronics Upgrade could be changed to QL 200 so it would fill up 200 points to City Controller (drops in all alien sectors) which means that 5 of these items is enough for CC's daily need. If lots of CRUs are bought from shops, it also acts as a new credits sink... Probably more people would also raid alien sectors or team RK missions... So drop rate should be adjusted as well for Intrusion/CRU items.
Numbers used in this suggestion are just example values and should be adjusted so that it's not too difficult to keep the City Controller filled and not too easy either. For 10 or so org members it should be pretty simple task to keep the city controller filled.