@rivenskye I have also written about that specifically but I try to address it via example in the above text. https://opsec.riotmedicine.net/downloads#threat-modeling-fundamentals