An institution that stops updating its threat model is getting ready for the next threat to take it by surprise.