How to Build the Right Security Assessment