Threat modeling

Threat modeling asks what could go wrong here while the answer is still cheap to act on. Code review finds the bug you wrote; threat modeling finds the defence you never designed.

Four questions structure the whole exercise:

1. What are we building?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good enough job?

The output is a short list of decisions, not a risk register nobody reads.

1. Draw the system and mark the trust boundaries

You cannot reason about attacks without knowing where untrusted things meet trusted things.