I once inherited a FAIR-based risk program where some of the security scenarios didn't pass a basic reality check. When I dug deeper, I discovered most of the impact estimates were based on a vendor marketing report that turned out to be a poorly designed survey with a tiny sample size and no disclosed methodology. The data wasn't relevant to our company size or sector, but someone had plugged it directly into the model anyway.