What’s fixed and what’s in flux The first question of threat modeling is “what are we working on?” Most systems have elements being worked on in this sprint/this iteration, and elements which are both fixed and worth showing on a diagram. For example, if you’re working on a front end, it might be worth including a load balancer and a database. Show what’s being worked on with hatch-marks, dots, bold lines, or other conventions. Again, the convention you’re using should be in the key unless you have a strongly enforced organizational norm, and the diagram won’t be shared with customers. (6/9)