&gt; I&#x27;m sure threat modelling is something everybody does implicitly.<p>You may work somewhere that this is the case, but I can&#x27;t count the number of times I have tested an application where someone has equated security to having an A+ HTTPS rating.<p>&gt; This is a slide deck<p>Understood, and something I didn&#x27;t consider before. That said, I think my comments will still be useful to those here who have also not seen the original talk.