High-level overview of instance-centric threat modeling. The design model (e.g. Figure 4.4) specifies the high-level structure of a system and can be analyzed to reveal major flaws in the design, but the resulting risk values will be inherently uncertain as the design model covers all potential configurations and scenarios. One or more instance models (e.g. Figure 4.5) can be created to model specific instances of the entities in the design model, with concrete parameters, which allows for more precise risk calculation [7].