Is a threat assessment really necessary?
In theory, you could conduct a vulnerability assessment of an asset without first completing a threat assessment. However, the findings and recommendations of the vulnerability assessment will be more specific, more closely tailored to the asset, more accurate, more reliable, and more helpful to you if a threat assessment is performed and design basis threats prepared in advance of the vulnerability assessment.
