Three Pillars of a Scalable Threat Modeling Practice