“If you don't threat model, you're shooting in the dark and hoping to hit the right things.”

Transcript evidence from Adam Shostack – Threat Modeling – 5 Minute AppSec.