In which of the five main phases of secure application design and development, you perform Threat Modelling?

Training is a preparatory phase focused on educating developers and stakeholders on security practices and is not where application-specific threat analysis is conducted.

The Define phase focuses on gathering requirements and defining security objectives, but threat modeling requires an existing architecture with data flows and components to analyze.

The Design phase is when system architecture, data flows, and trust boundaries are defined, making it the ideal point to perform threat modeling using frameworks such as STRIDE or PASTA. Identifying threats at design time allows teams to build mitigations into the architecture rather than retrofitting them later, which is both more effective and less costly. This placement aligns with industry-standard secure development lifecycles including the Microsoft SDL and OWASP SAMM.

By the Develop phase the architecture is already fixed, making threat-driven design changes costly to implement; threat modeling must precede coding.

The Test phase validates whether implemented controls function correctly and occurs too late in the lifecycle for threat modeling, since the design and code already exist.