modeling threats is easy but convincing product managers that threats are real is the actual challenge here
