BCS Practitioner Certificate in Information Risk Management

A CISO argues that classical risk models are difficult to apply to information security in her organisation. According to the BCS article, what is the fundamental reason for this difficulty?

A risk analyst notes that staff consistently insist a very rare type of security compromise is far more likely than the data suggests, leading to excessive spending on countermeasures. Which behavioural tendency described in the article best explains this?