report of the actual risks to the software intensive system.
This said, until recently, the absence of software-specific risk
assessment and threat modeling techniques and tools left only one option
to software teams: attempt to apply system-level risk assessment techniques