The Vulnerability Assessment and Mitigation (VAM) methodology helps to think beyond known vulnerabilities and head off surprise attacks.