Today, folks would look at you screwy if you dared suggest that QA shouldn’t be done early on in the SDLC. This is threat modeling as an afterthought, similar to how QA used to be an end-of-the-development-cycle thing. So, we throw together a data flow diagram or two, perform some static or dynamic scanning of application code snippets (that entirely miss the holistic application threats picture), and we think we’re covered, right? Or, some might choose to wait until everything is pretty much baked and then do static or dynamic analysis on the whole shebang only to find out that somebody forgot to do something and now it’s back to the drawing board. Instinctively, we know threat modeling makes sense but then there’s the CI/CD mad scramble to get product out the door to meet release dates before heads start rolling. Threat modeling employs a, 'best defense is a good offense' perspective.

Threat modeling is a process by which organizations can shift their security approach from reactively mitigating exploits (continuously pouring molten tar on the heads of the barbarians at the gate) to proactively and systematically understanding and addressing potential threats during the application design stage.

One of the most effective methods used to ensure application security during the design process is, threat modeling. And why it’s bottlenecking your DevOps to DevSecOps transition

Microsoft threat modeling tool examples