What is a common mistake when working with threat modeling?

A common mistake with threat modeling is performing threat modeling once as a compliance document and never updating it causes the model to diverge from the real system. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.