@calamari Amen. Auditors are more likely to drive threat models than real adversaries.