Actually I think that's roughly how threat analysis works though.

For threat analysis, you need to know how hard you are to break in, what the incentives are, and who your potential adversaries are.

For each potential adversary, you list the risk strategy; that's threat analysis 101.

E.g. you have a locked door, some valuables, and your opponent is the state-level. Risk strategy: ignore, no door you can afford will be able to stop a state-level actor.