A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.