The part I've been struggling with is getting them to put any threat model in writing that's not quote, "everything".