Then he posed an analogous problem in information security, with the claim that probabilistic analysis would show that new security investments are unjustified. To backup his point, he uses the example of the Two Envelopes Problem in Bayesian (subjectivist) probability, which can lead to paradoxes. Luther Martin, blogger with Voltage Security, has advised caution about using of risk risk management methods for information security, saying it’s “too complicated and subtle” and may lead decision-makers astray. Is risk management too complicated and subtle for InfoSec?