Threat Model Repair