u No support for relating threats to financial losses caused by attacks
u No ranking or prioritization of countermeasures according to their
effectiveness in reducing risk
Software Security Assurance State-of-the-Art Report (SOAR) 149