A security architect or developer needs to conduct a STRIDE threat model on a new system or feature design — typically represented as a data flow diagram, architecture description, or API specification — and produce a structured threat register with mitigations that can be tracked in a product backlog. Most developers lack threat modelling training and produce incomplete or inconsistently structured outputs.