Question

At what point in a vulnerability assessment would an attack tree be utilized?

Answer 1

During threat evaluation - A vulnerability assessment is done to gauge the impact expected from a successful attack and also how vulnerable the software is to an attack. An attack tree, when created during the threat evaluation phase allows one to analyze and describe possible attacks that can be realized on the system.