I think this in point. "[Treat] the attacker user personas with the same primacy as those of the customer user personas — [put] them on a wall in the office and

I think this in point. "[Treat] the attacker user personas with the same primacy as those of the customer user personas — [put] them on a wall in the office and [have] everyone conversant in their "needs". Another solid piece that goes into more of the details of threat modeling: https://increment.com/security/approachable-threat-modeling/ https://increment.com/security/approachable-threat-modeling/