This line of research has the aim to develop a risk management process which is suitable for the modern dynamic IT world (Web Services, Cloud Computing, Grid, mobile networks). Risk management is a process which helps to organize security activities in the most efficient way in order to protect valuable assets. Current risk management practices are static and heavy depend on security personal. Thus, our goal is to consider how the data collected from different, sometimes untrusted sources must be processed and made useful for further analysis, how this data should be analysed and how decisions could be made in an automated or semi-automated way. For example, currently we are working on empowering the usage control model (a successor of access control) with risk analysis. Such analysis must take into account that collected data are not always fresh because of dynamicity of the environment and, therefore, an access decision could be incorrect.