Describe a feature or system (components, data flows, who talks to what) and get a STRIDE threat model in a form you can put into a design review. It lists what is worth protecting, marks the trust boundaries, then goes through each component and data flow with a table of spoofing, tampering, repudiation, information disclosure, denial of service and privilege escalation threats. Each threat is rated for likelihood and impact and comes with a specific mitigation. It finishes with a prioritized fix list, the three biggest risks and the assumptions it made.