Prospective risk analysis is difficult in complex sociotechnical systems where humans interact with one other and with information systems. Traditional prospective risk analysis methods typically capture one risk at a time and rely on the specification of a chronological sequence of errors occurring in combination. The aim here is to introduce agent-based risk assessment (ABRA), which addresses these issues by simulating multiple concurrent and sequential interactions amongst autonomous agents that act according to their own goals. The methodology underlying the construction, simulation and validation of ABRA models is detailed along with practical considerations associated with implementation, for which the Brahms agent-based simulation framework is used. The challenges of implementing agent-based risk assessment models include the need for well-defined work processes and reliable observational data, and difficulties associated with behavioural validation. As an example illustrating the technique, a simple race condition hazard is implemented using an ABRA model. The work process involves a human operator and a machine interface that interact to sometimes produce the erroneous transfer of information. The correctness of the model is confirmed by comparing the simulated results against the well-defined theoretical baseline.