1. A method to assess information security vulnerability of an enterprise comprising: storing enterprise objectives in a computer system; storing enterprise resources determined using a value criterion, a rareness criterion, an inimitability criterion and a non-substitutability criterion in the computer system; storing enterprise information assets in the computer system; mapping the enterprise objectives with the enterprise resources; mapping the enterprise information assets with the enterprise resources; determining a threat analysis using an attack tree using the enterprise resources and the information assets; and determining a risk value using the attack tree.