When performing threat modeling, the security analyst should address not only known threats, but also emerging $($and zero$-$day$)$ threats, even though they have not been validated, but have been reported in threat intelligence reports.