A team is designing a new cloud payment API. When should threat modeling begin for the greatest design benefit?

1. During architecture and design, with updates as the system changes
2. After disabling all security testing in the build process
3. Only when the application is being decommissioned
4. Only after the first confirmed production compromise