Proper threat modeling requires the correct analysis of potential vulnerabilities. Poor or improper project scoping causes uncertainty for ethical hackers and the client. When a web or mobile application is improperly scoped against security weaknesses, pen testers may spend time and resources creating threat models that do not apply to or provide the best value for the client.