Risk management at a systemic level is complicated enough that many organizations deem it practically impossible. Yet constructing and applying risk and threat models appropriately is the cornerstone for any successful security program; since they focus energy on 1) what needs to be protected and 2) how much investment is needed. In this talk Alex Hutton and Allison Miller will show how risk models can be translated from the white-board to implementation.