Threat modelling is a structured way of identifying, understanding and prioritising security threats to a system - ideally before that system is built, while design decisions are still cheap to change.
Rather than waiting for a penetration test to find issues after the fact, threat modelling asks a simpler set of questions up front: what are we building, what can go wrong, what are we going to do about it, and did we do a good enough job.
Common frameworks
STRIDE categorises threats into six types - Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege - and is often applied against a data flow diagram of the system.
PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric methodology that ties technical threats back to business impact, which makes it useful when you need to communicate findings to non-technical stakeholders.
Why it matters early
Fixing a design flaw during the design phase is far cheaper than fixing it after the system is in production and has real users and real data. Threat modelling doesn't replace testing - it reduces the number of expensive surprises testing turns up later.