I ve been spending a lot of time lately looking at infrastructure security, specifically how complex vulnerabilities are often an emergent property of standard coding and Terraform configurations. I m currently building a tool that parses IaC to automatically map out STRIDE threat models, but before I go too far down the rabbit hole, I wanted to ask how teams are handling this in the real world...