A one-page threat model
Why it matters You cannot protect everything from everyone, and trying to leaves you tired and no safer. A threat model is a short, honest page that tells you what is worth protecting, from whom, and which few steps make the biggest difference. Every other lesson in this course becomes easier to act on once you have one.
Locking your house
You already threat model without the name. You lock the front door because burglars exist, but you do not install a bank vault, because nobody is tunnelling in for your spoons. You decided what matters (your family, your laptop), who might come (an opportunist), what they can do (try the handle), and what is worth the effort (a good lock). That is the whole method.
Threat model: a written answer to "what am I protecting, from whom, against what, and what will I do about it?". It turns vague worry into a short list of decisions.
Four questions
A popular way to start, widely used by security teams, is four plain questions:
- What are we working on? The person, product or system, and the data it holds.
- What can go wrong? The threats.
- What are we going to do about it? The mitigations.
- Did we do a good job? A check, now and again later.
The words you need
Asset: something worth protecting. For privacy it is usually data: your location, your messages, your browsing history, a customer list.
Adversary: someone who might want an asset. Not always a villain: an advertiser, a nosy relative, a former partner, a data broker, a careless employee.
Capability: what an adversary can actually do. A stranger online can read your public posts; your phone company can see which numbers you call; someone in your home can pick up your unlocked phone.
Threat: a specific thing that could go wrong, written as "adversary does action to asset". For example, "an ad network links my visits to three shops into one profile".
Mitigation: a step that makes a threat less likely or less harmful. Some threats you simply accept, on purpose, because the fix costs more than the harm.
Score, then sort
Give each threat two small scores from 1 to 3: likelihood (how likely is it?) and impact (how bad if it happens?). Multiply them to get a risk from 1 to 9. Then deal with the highest numbers first. It is rough, and that is fine: the point is to compare threats with each other, not to be precise.
| Threat | Likelihood | Impact | Risk |
|---|---|---|---|
| A reused password leaks in another site's breach | 3 | 3 | 9 |
| Ad networks profile my shopping | 3 | 1 | 3 |
| Someone steals my laptop from home | 1 | 3 | 3 |
Here the clear first job is unique passwords or passkeys, not a new browser extension.
The one page
Fit it on one page with five short sections: what (assets), who (adversaries and their capabilities), what could go wrong (threats with scores), what I will do (mitigations, and which risks I accept) and review date (when you will look again, because life changes).
A common misconception
"Threat models are for spies and big companies." The most useful ones are small and personal. A threat model that takes ten minutes and changes one habit beats a perfect one that never gets written.
Try it On paper, list three assets you care about online, two adversaries who might want them, and one threat for each pair. Score each threat. Circle the highest. That is your first threat model.
Recap
- A threat model answers: what am I protecting, from whom, against what, and what will I do?
- Assets are what you protect, adversaries are who wants them, capabilities are what they can do, threats are what could go wrong.
- Score likelihood and impact from 1 to 3, multiply for risk, and fix the biggest first.
- Accepting a small risk on purpose is a valid decision; write it down and review it later.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.