“The first thing you need to do is create some a model.”

Transcript evidence from Steven Wierckx -- The #OWASP Threat Modeling Project.