Very interesting comment, thank you for sharing your thoughts. I particularly enjoyed your depiction of security products. Years ago, I advocated strongly for

Very interesting comment, thank you for sharing your thoughts. I particularly enjoyed your depiction of security products. Years ago, I advocated strongly for threat modelling and bringing the process "to the masses". I was a security consultant, it was easy for me to tell others what they should do. Then I started working as an "internal" in an company large enough to offer me both many different perspectives and full access to things that needed threat modelling. Architects and developers I only interacted with as my "customers" became my colleagues. And my point of view completely changed. I agree with you: threat modelling, as it is "evangelized" today faces strong resistance from business as an expensive and negative activity. The infrequent times it is enjoyed, reasons are not those we think: threat modelling is really a "cool" experience when done correctly, participants learn a lot of things and usually enjoy the activity. Then comes the second round. And the third. And that's where you see it hits a wall: either you repeat the same thing, again and again, or participants don't have the time. Today, I still do threat modelling, and quite actively. On my own, as you said. My colleagues don't even know I use this process to prepare my internal publications. I write threat advisories, which I then send to a little more than 300 architects, developers and project managers worldwide. My recommendations are the output of a threat modelling process, these advisories fly into the field in a "finished" state. Threat modelling leverages its full strength in environments that can benefit from high capitalization of thought, such as when you deal with a large number of silos/teams that are exposed to very similar problems. There is a very simple trick to catch wannabe threat modellers: look for threat models that include a "validate all input" recommendation or alike. If you see this in a threat model, you know you are dealing with someone who hasn't actually understood what threat modelling is and is simply repeating some tricks learned the evening before. I could also talk about what I think of security vendors that try to sell threat modelling as some sort of "transferable" skill, which can be taught in one or two days to non-security professionals. But I will refrain. Now about the manifesto. In my opinion, Adam Shostack deserves full credit, not for inventing threat modelling but for actually formalizing the process in its most efficient and final form (i.e. the 4 threat modelling "questions"). All attempts to complete his work (e.g. books, methodologies, articles, etc.) following his release of the 4 questions are nothing more that complicated "techniques" to derive threats from a diagram or a specification.