Experience with Risk Assessment tools, such as RiskWatch?

[James Moore <jhmiso () RIT EDU>]

Does anyone have experience with RiskWatch or other tools that help to quantitatively define risks in information 
systems?  I have looked at RiskWatch, and they seem pretty good, but I just haven't found any other similar tools for 
comparison.  Any experiences in implementing internal risk assessments?  RiskWatch also has an ISO 17799 base, so 
experiences (and tools) for leveraging that standard in a higher ed environment are also welcome.
 
Thanks,
 
Jim