Embed Notice

@ryanc @aris But if you do threat modelling properly, you do that. You identify the sort of people who might want to gain access.and why.

I see your point about making them easier to understand, but I worry that they can be too simple.

Also so often, a threat model identifies areas of threat. The threat actors can and will change. Security dev always needs to be flexible and changeable - in weeks/months, not years.