Agile Risk Assessment Depends on Ad Hoc Analysis