they are difficult if not impossible to use by anyone who is not a security expert.
Because a tree is a “list of security-related preconditions,” it is unrealistic to
expect a non-expert to accurately generate an appropriate list of securityrelated preconditions. Microsoft is one software development organization
that has discovered that painstakingly generated security-related preconditions