Asked questions to understand the architecture first. Then provided steps for Threat Modelling, Pen testing, software composition analysis and risk assessment methodologies.