The biggest obstacle I struggle with in getting good threat modeling done is keeping the model up to date as design decisions and constraints change.

Building a threat model in to the ‘design phase’ only makes sense if you have a design phase - but an iterative dev cycle is just continuous overlapping design and dev phases. It can be really hard to recognize that a particular iteration of a design change is the one that broke one of the assumptions built into your previous threat model.

I’m really interested in ways to turn threat models into verifiable constraints and executable tests so iterative development can proceed safely in the framework of agreed security guardrails... but most threat modeling literature seems to end at ‘having a threat model’, not ‘verifying your threat model actually applies to your system’...