The Ee Bomb and the S Bomb on Threat Modelling

threat modelling is usually happening very late in the game, when you have a provision infra structure. You can querry, do i have a vulnerable public based on code only, without provisioning anything to production. There would be an indebect trg analysis of the emtan application. It gets into a very big chek list for a threet year web application like the cosecury potcas web side. Do you think that weare being idealistic by the going on the spot? In a lot of ways, it sounds like a lot of work, but it also seems, is that really practical as well? O, i may totally make sense, but how many