One criticism of classic quantitative risk analysis is that:

it is only useful in cases in which long$-$term employees are vetted, in case of insider sabotage

the results depend on non$-$repetitive threats, i$.$e$.$ those that have a high chance of occurring only once

possible countermeasures and the assets to be protected have a many$-$to$-$many relationship

only a qualified insurance actuary is allowed to conduct these types of analyses