A team wants to address abuse cases before implementation. Which activity best supports this?

1. A release date chosen before requirements
2. A penetration test only after retirement
3. Compiler optimization alone
4. Threat modeling during design