A security assessment scheduling tool uses a configuration file that is configurable via a user interface, to specify one or more elements of an application to be analyzed during the scoping process. Further, the security assessment scheduling tool may automatically schedule assessments for large numbers of applications using one or more constraining optimization techniques and/or via modeling the scheduling problem as an RCPSP problem. The security assessment scheduling tool processes the RCPSP problem for a defined period of time and then schedules remaining unscheduled applications within a specified time period thereby allowing the security assessment scheduling tool to schedule assessments of tens of thousands of applications.