I think, therefore I act, Revisited: Building a stronger foundation for risk analysis