Purpose and principles of quantitative risk analysisQRA is not always neededWhere QRA is required, know why and how to use itNo models are “correct”Include all types of uncertaintyUse best available dataUse the resultsSummaryTypical techniques for modelling threatsMonte Carlo simulationGenerating input dataUnderstanding outputsUsing QRA results to evaluate overall project riskModifying threat techniques to model opportunitiesWrite it downSummary and reflection questionsReflection questionsThe next step (“Now we’ve quantified overall risk exposure, what can we do about it?”)