“Translating the ASVS requirement into a threat and saying, for those people that are new to this and they don't have the mental models of all the things that we've done where we've seen different threats, and so we can see them jump off the page.”

Transcript evidence from Adam Shostack -- Fast, cheap and good threat models.