I have a medium sized application (say 50k lines) that occasionally will
spike the % of time in RT security checks performance counter between 50 and
95%.

It can perform hundreds of thousands of code access security permission
checks in a few seconds in some cases.

I know that I can set a permission set on a higher level method and demand
then assert to help allieviate some of these checks, but how do I go about
determining what method to assert the permissions and which permissions to
assert?

I guess what I'd really like is to get a list of methods with the number of
calls and the number of code access security permission checks performed
(inclusive and exclusive).

Any ideas of how I can go about profiling/debugging this issue?