In secure software design and development, what is meant by threat modeling?

A. writing code with no assumptions B. formatting the final report C. only buying hardware D. identifying likely threats and designing mitigations before or during development