Using threat modeling to get your priorities right