Which statement best describes the purpose of threat modeling?

A. writing code with no assumptions B. formatting the final report C. identifying likely threats and designing mitigations before or during development D. only buying hardware