Threats follow data. Understanding how data flows through a system is central to identifying potential vulnerabilities. Mapping data flows allows developers to pinpoint where sensitive information is handled and where it may be exposed to threats. Frameworks like STRIDE [STRIDE] are useful because they provide structure and direct attention toward categories of attack.
When addressing the question "What are we going to do about it?", the default is sometimes to state the problem in inverse language or to reach for a security control. SSEM provides a more structured alternative. Considering the SSEM attributes, particularly Trustworthiness and Reliability, can lead to existing architectural or logical solutions that address a threat more holistically. Further, when it becomes clear that a threat cannot be addressed through an inherent system attribute, that recognition defines a requirement: the gap must be addressed through explicit security requirements.