> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What! Think before coding? WHY?

- URL: https://www.ostering.com/threat-modeling-culture/
- Published: 2025-08-27T06:21:00.000Z
- Updated: 2025-09-21T13:13:43.375Z
- Description: What! Think before coding? WHY?, ostering.com, Brett Crawley
- Author: Brett Crawley
- Tags: Security by Design, Threat Modeling

Why are so many people just diving, straight into the code? A minimum of requirements and design? Perhaps a threat Model?

---readmore---

## Threat Modeling

### Threat modeling is upfront investment.

![Feature Express](https://www.ostering.com/media/posts/37/threat_modeling.png =1024x1024 "Feature Express")

I often hear teams saying: 
 - They don't have time to threat model.
 - They have deadlines.
 - We'll do it after we've released.

### Look at the consequences.

![Threat Modeling Too Late](https://www.ostering.com/media/posts/37/post-releast-tm.png =1024x1024 "Threat Modeling Too Late")

Doing it later is often too late, the damage is done and they either need to go back to the drrawing board or add a patch, meaning the security of the product will never be as strong as it could've been. This is their first step onto the slippery tech debt slope.

### Is this familiar?

![Exponential Vulnerability Backlog Growth](https://www.ostering.com/media/posts/37/without-tm.png =1024x1024 "Exponential Vulnerability Backlog Growth")

Not threat modeling also allows vulnerabilities to propagate and the backlog to grow exponentially causing a snowball effect.

### By doing this...

![Threat Model Early](https://www.ostering.com/media/posts/37/design-phase-tm.png =1024x1024 "Threat Model Early")

Threat modeling early allows you to fix things cheaper, with less effort, it's predictable because you can plan the fixes into the development and simply makes more sense.

### You reach this...

![Vulnerability Utopia](https://www.ostering.com/media/posts/37/with-tm.png =1024x1024 "Vulnerability Utopia")

Not only that but because you have reduced the flow and stopped the hemoraging of vulnerabilities, you can start to work of the existing backlog, gradually moving towards a kind of utopia.