<p>An institution that stops updating its threat model is getting ready for the next threat to take it by surprise.</p>