Most teams threat model what they intended to build, not what is actually deployed. This talk exposes that blind spot and shows how to extend threat modeling beyond design by incorporating real SAST, SCA, DAST, IaC, and cloud findings.