To determine the structure of your security program, you need to determine the likely threats that you will face. By understanding your threats, you can determine the attack methods that might be used against you. Even if the threat is not malicious, you must acknowledge that there will be vulnerabilities exploited. Thus you can determine the vulnerabilities that should be prioritized for mitigation.
“If you know yourself, but not the enemy, for every victory gained, you will also suffer a defeat.”