Abstract: A system and method for modeling information security risk to an enterprise are disclosed. The method includes providing multiple input media, each of which forms a vector of risk severity in a dimension characterizing the information security risk. Each vector is of a dimension distinct from that of each other vector. The input media are user interactive for providing input to a computer in a network environment. The input includes data corresponding to the magnitude and dimension of each of the vectors. Upon receiving the input, the vectors are processed to output a model of the information security risk. Each risk can be modeled from the perspective of at least two dimensions, one related to a technical exploitation aspect of the risk, and the other related to a risk aspect associated with business impact. The input media can be a web based application.