A really good explanation of the bow tie method can be found on https://www.youtube.com/watch?v=dpGKHncw-d8 https://www.youtube.com/watch?v=dpGKHncw-d8 Though

A really good explanation of the bow tie method can be found on https://www.youtube.com/watch?v=dpGKHncw-d8 https://www.youtube.com/watch?v=dpGKHncw-d8 Though I can see it helps in the analysis of a specific event, I feel to grasp how to use it to map risks a priori (in the area of cyber security). The total number of possible threat events run in the billions if you count all the possible threat actors, threats, vulnerabilities and impacts. In the linked article, "car skids on wet road into tree" is just one event. Well, it could also have blown a tire or hit a cyclist instead. Do I make separate bow tie for each of those events? And how do I add up those risks? Risk/car owners just want to know how safe their car is. How does it help to map all possible failure modes? And if this is not the right method for it, what is?