expand on 'Not doing a threat model is not thinking about end-to-end security design'

[DinisCruz]

Where we need to open an RISK ticket saying "This app/feature has not done a Threat Model and considered its security implications"

as michael mentions here

in http://www.slideshare.net/DinisCruz/making-threat-modeling-so-easy