Quantitative Risk Analysis of Computer Networks (QSRA) addresses the problem of risk opacity of software in networks. It allows risk managers to get a detailed and comprehensive snapshot of the constitutive software on the network, assess its risk with assistance of a vulnerability database, and manage that risk by rank ordering measures that should be taken in order to reduce it, subject to cost, functionality and risk constraints. A theoretical methodology is proposed and a prototype implementation has been developed. Six out-of-the-box popular operating systems were studied using the methodology and the prototype.