Entering a test blindly inflates both budget and production risk. Threat modeling makes assets, trust boundaries, actors, and likely attack paths visible. A new product architecture, payment flow, Active Directory change, or external integration requires this work. Output can be STRIDE-like classification or a scenario list in your language; a universal template is not forced. Modeling does not replace pentest; it shows which pentest type, in which order, is meaningful.
TARGON runs threat modeling as a technical planning session, not a sales deck. Kaspersky, systems, AD, and pentest views sit at the same table; scenarios become testable hypotheses, not a fear list. Scope is set by a workshop, architecture diagrams, and limited interviews; there is no claim to model every hidden system. Taking threat modeling from TARGON improves the aim of later web, API, internal, or red team work.