1. A computer-implemented method for technology risk assessment, comprising: identifying software characteristic values, each being associated with one of a set of software characteristics including at least respective user oriented, software oriented, system oriented and security oriented software characteristics, the software characteristics being associated with multiple sets of at least one software process each, wherein each software characteristic defines a property of an associated software process as a value within a range, wherein each software characteristic value reflects a degree of contribution to at least one of multiple security risk categories by the software process; determining a modifier and applying it to the software characteristic value of at least one of the software characteristics of at least one of the software processes, the modifier depending on an extent to which a technology control increases or decreases a degree of contribution by the software process to at least one of the security risk categories associated with the software characteristic; calculating risk indexes, at least one for each of the multiple security risk categories regarding each of the software processes, the risk indexes including at least respective confidentiality, data, reviewability, communication and security risk indexes, wherein for each software process each risk index is determined as a function of at least a subset of the software characteristic values of the software process, and wherein at least one of the subsets includes the modified software characteristic value; aggregating at least some of the risk indexes into (i) a computer network risk index based on the corresponding risk indexes of the set of software processes that are executed at a computer device or (ii) a computer device risk index for the computer device; and presenting an enterprise risk assessment on a display device, wherein the enterprise risk assessment is based on the risk indexes for the software processes, and the computer network risk index or the computer device risk index, wherein the enterprise risk assessment indicates whether computer devices have particular aggregated risk index values for one or more of the multiple security risk categories.