During threat evaluation - A vulnerability assessment is done to gauge the impact expected from a successful attack and also how vulnerable the software is to an attack. An attack tree, when created during the threat evaluation phase allows one to analyze and describe possible attacks that can be realized on the system.
