Any organization with valuable data has been or will be attacked, probably successfully, at some point and with some damage. And, don't all digitally connected organizations have at least some data that can be considered 'valuable'? By “system architectures” I meant to include any system that requires digital security, be it the architecture of a discrete application or program, a library or application programming interface (API), a global cloud, an organization’s digital assets, etc. Th ough my definition may have sufficed for the purposes of a book on threat modeling, it still feels a bit too opaque, and I fear that it excludes some important aspects.