There have been two methods of estimating computer related security risk such as qualitative and quantitative methods which have distinctive advantages or disadvantages. The former is too narrative and somehow abstract to implement and the latter produces concrete result but needs lots of data, so that it is needed to develop a method overcoming such difficulties. It is advised to mix such two methods in a proper way depending on the conditions of a computer system. In this article, a concept of fuzzy number is employed on the way of mixing the two methods and provide a simple example using fuzzy numbers. Simulation was conducted for an assumed model system and it is demonstrated how to calculated expected and unexpected risk.