“My goal is first to catalog, and then when we have catalogs of both the threats and the controls, we can start to build out threat modeling processes, methodologies that help you take this from here's a list of problems to here's the way to think about this as you're building what you're working on.”

Transcript evidence from Adam Shostack — Threat modeling layer 8 and conflict modeling.