take some time and think through whether you think threat trees or threat asset matrices would seem the best way to develop a security assessment methodology. Many security consultants use these tools to build excellent consulting practices, so this consideration exercise might help you with your new business!