At what point in a vulnerability assessment would an attack tree be utilized?

During threat evaluation - A vulnerability assessment is done to gauge the impact expected from a successful attack and also how vulnerable the software is to an attack. An attack tree, when created during the threat evaluation phase allows one to analyze and describe possible attacks that can be realized on the system.

You aren't giving enough information. what kind of "tool" do you mean? if you want an opinion, then jeremy should use a computer to show how his web will look like.