“There's like all this information about how the application works that you need to understand before you can start doing a threat model, before you can start doing a pen test.”

Transcript evidence from Jeff Williams -- Application Detection & Response (ADR).