Also as common practice in the Information System security management area, people do not use a lot of quantitative analysis or software tools for risk. They use templates, and professional judgment usually. This is pragmatic enough in usual situation but also means there may be marketing opportunity to develop novel enterprise architecture risk management suites.