Most AppSec programs prioritize based on discovered vulnerabilities, leading to alert fatigue and wasted effort. This session makes the case for a threat-centric approach, where security priorities stem from threat models tied to business context instead of raw scan results. We’ll show how continuous threat modeling from design docs, diagrams, and code enables smarter prioritization, cutting security backlog, shipping products faster, and improving coverage without slowing developers.