Most security reviews start with a checklist. The trouble with checklists is that they answer questions somebody else thought to ask.
Threat modelling starts differently — with the boring architecture diagram you already have. Boxes, arrows, and one question at every arrow: what happens if this line lies?
STRIDE gives you six prompts for that question. Spoofing — pretending to be someone. Tampering — changing data in flight. Repudiation — denying it ever happened. Information disclosure — reading what isn't theirs. Denial of service — making it unavailable. Elevation of privilege — becoming more than they are.
Apply them at trust boundaries, the places where data crosses from something you control into something you don't. Browser to your API. Service to another service. Your system to a third party. One tenant to another.
What the taxonomy buys you is timing. The question gets asked at design time, while changing the answer is still cheap.
We don't find the flaw by staring harder at our own design. We find it by describing the same design from the outside.