The article discusses how organizations manage risks using qualitative or quantitative models. Qualitative models are easier to use but can lead to errors and biases. Quantitative models involve numerical measures and are more objective. Lessons from medical and financial fields can help improve information security risk management. Survival analysis from medicine and credit risk models from finance can provide valuable insights. Learning from past financial crises can help prevent similar mistakes in information risk management.