Our development teams are getting the hang of STRIDE threat discovery, but one issue that remains is related to threat decomposition.
The way we see threat analysis is that it consists of identifying applicable threats and then determining what types of attacks (be it attacks like XSS, or misuse of poorly-designed control flow) can realize those threats.
This threat decomposition is tricky, as the quality of this task is determined by the target of analysis, the knowledge (and even something as trivial as mood) of the group performing the analysis, and the time dedicated to this activity. We quickly determine "low-hanging fruit" issues, and then as times go on fewer and fewer credible attack vectors are determined.
What are the acceptable approaches for determining the stopping condition of threat decomposition? Is it simply a time? How are organizations handling this?