Just in case someone revisits this old conversation, there’s a related interesting topic here:
It has different views about the relation between risk assessment and threat modeling. @adamshostack who spawned the topic suggests entering risk management discussions only when issues can’t be fixed easily…