The risk assessment methods are okay. It's the risk models and empirical data as mentioned that are lacking. That is because information security, threats, potential perpetrators, and vulnerabilities are unbounded, open-ended, and changing. There is simply too much we don't know, and factors materially change faster than the the time it takes to do the analysis. That is why I advocate a diligence method based on experience, observation, current practices, and decisions by management fiat using: Benchmarking, standards, compliance, contracts, audits, good practices, available products, cost, and experimentation.