[tshadwell]

> I'm sure threat modelling is something everybody does implicitly.

You may work somewhere that this is the case, but I can't count the number of times I have tested an application where someone has equated security to having an A+ HTTPS rating.

> This is a slide deck

Understood, and something I didn't consider before. That said, I think my comments will still be useful to those here who have also not seen the original talk.