“If you were to create some very good threat models on that, then an organization that is new to threat modeling could take the reference threat model, see how their applications differ from that one, and then you need to do the threat modeling on the small differences.”

Transcript evidence from Steven Wierckx -- The #OWASP Threat Modeling Project.