Examine your threat environment periodically (by reviewing reports from public agencies and companies).
Sources of threat (i.e., insiders, competitors, criminals, terrorist groups) should be identified.
Determine possible novel attack vectors and trends based on current events and past incidents.
The most important thing is to build defences that will help mitigate security threats to the organisation.