To says things simple ; when someone wants to learn offensive web application (or system) hacking, one could just download OWASP DVWA or register to Hackthebox and watch Ippsec videos to see "how to walk the walk". This is very tangible and practical (no theory circle)
But what about risk analysis (ex : ISO 27005, NIST SP 800-30, EBIOS, etc...) ? The only thing I see on the internet is tons of theoretical paper about why those methods are so great etc... There is no practical use case showing how it was applied in more specific situations.
I understand it may be not a good idea to publish your organization risk analysis results on internet but how are we (beginners) suppose to do it ?
Any idea where I should start or look into to get a more realistic practical overview of IT security risk analysis ?