Perhaps this is it?
https://researchoutput.csu.edu.au/en/publications/the-quanti...
Wright, C. (2017). The quantification of information systems risk: A look at quantitative responses to information security issues Australia: Charles Sturt University
Doctor of Philosophy