Personal Threat
Modeling
Most security advice is generic. Threat modeling is the opposite — it's a framework for thinking clearly about your specific risks, so you can protect what actually matters without wasting energy on threats that don't apply to you.
The landscape
The five questions every threat model starts with
What do I want to protect?
Your assets — files, accounts, location, communications, identity, financial data.
Who do I want to protect it from?
Your adversaries — ex-partners, employers, advertisers, criminals, governments, or opportunistic hackers.
How likely is it that I'll need to protect it?
Probability — a realistic assessment, not worst-case paranoia. Most people face mundane threats.
How bad are the consequences if I fail?
Impact — financial loss, reputational damage, physical safety, loss of privacy, professional consequences.
How much trouble am I willing to go through?
Your tolerance for friction — the right security is always a trade-off between protection and convenience.
Framework adapted from the Electronic Frontier Foundation's Surveillance Self-Defense guide.
Why Generic Security Advice Isn't Enough
"Use a VPN." "Enable two-factor authentication." "Don't click suspicious links." This kind of advice shows up everywhere — and it's not wrong, exactly. But it treats security as a checklist rather than a thinking exercise, which means you end up either over-protecting things that don't matter or ignoring risks that are genuinely relevant to your life.
A journalist investigating government corruption has very different security needs than a parent worried about their teenager's online activity. A small business owner handling client financial data faces different threats than someone who just wants to keep their email private from advertisers. No single checklist covers all of these well.
Threat modeling solves this by asking you to think before you act: What are you protecting? From whom? At what cost? The answers to those questions determine which security measures are worth your time and which ones are overkill — or worse, security theater that gives false confidence without real protection.
🎯 The core insight of threat modeling
Perfect security doesn't exist. Every security measure has a cost — in money, convenience, time, or complexity. Threat modeling helps you spend those costs where they actually matter for your specific situation, and consciously accept the risks that aren't worth mitigating.
Step 1: Identify Your Assets
An asset is anything you value and would want to protect. In the context of personal digital security, this is broader than most people initially assume.
Start by making an honest inventory. Don't filter yet — just list what matters to you. You'll prioritize later.
🔑Digital accounts
- ›Email (the master key to everything else)
- ›Banking and financial accounts
- ›Social media profiles
- ›Work accounts and cloud storage
- ›Domain names or business accounts
📁Personal data
- ›Photos and personal files
- ›Health and medical records
- ›Location history and movement patterns
- ›Contacts and private communications
- ›Documents (passport, ID, contracts)
🪪Identity
- ›Your legal name and address
- ›Date of birth and government IDs
- ›Biometric data (fingerprints, face ID)
- ›Social security / national ID numbers
- ›Financial history and credit data
🤝Reputation & relationships
- ›Professional reputation
- ›Private conversations you'd regret being public
- ›Associations or memberships you keep private
- ›Your online personas or pseudonyms
- ›Relationships you want to keep confidential
✏️ Do this now: write your asset list
Not all assets are equal — prioritize ruthlessly
Once you have your list, mark each asset with a rough priority: high, medium, or low. High-priority assets are things where exposure would cause serious, hard-to-reverse harm — identity theft, physical danger, significant financial loss, or permanent reputational damage. Low-priority assets might be embarrassing if exposed but wouldn't cause lasting harm.
Your email account almost always deserves high priority — it's the recovery mechanism for virtually every other account. Lose control of your email and you effectively lose control of your digital identity. This is why email security is where most people should start.
Step 2: Know Your Adversaries
"Hackers" is not a threat model. It's a vague fear that leads to either paranoia or complacency. Real threat modeling requires identifying specific adversaries — or categories of adversaries — so you can understand their capabilities, motivations, and methods.
Opportunistic criminals
Capability: Low–MediumMotivation
Financial gain through automated attacks — credential stuffing, phishing at scale, malware distribution.
Who they target
Weak passwords, reused credentials, unpatched software, email inboxes.
Affects
Almost everyone
Core defense
Strong unique passwords, MFA, software updates. Most automated attacks move on quickly if you're not easy.
Targeted criminals
Capability: Medium–HighMotivation
Financial gain through targeted fraud — SIM swapping, spear-phishing, account takeover of specific people.
Who they target
High-value individuals — crypto holders, executives, public figures, people who have publicly announced wealth.
Affects
People who are identifiably high-value targets
Core defense
Hardware security keys, account freezes with carriers, separating high-value accounts from everyday accounts.
People you know
Capability: VariableMotivation
Control, jealousy, harassment, revenge — often an intimate partner, ex-partner, stalker, or estranged family member.
Who they target
Devices they have physical access to, shared accounts, location data, communications.
Affects
People in difficult personal relationships, domestic abuse situations
Core defense
Device PINs, removing shared account access, checking for tracking apps, separate accounts.
Employers and institutions
Capability: MediumMotivation
Compliance, monitoring, liability reduction — usually not malicious but still a privacy concern.
Who they target
Work devices, work accounts, network traffic on company networks.
Affects
Anyone using employer-owned devices or networks
Core defense
Never use work devices for personal matters. Assume work accounts are monitored.
Data brokers and advertisers
Capability: High (data collection), Low (direct harm)Motivation
Profit from your data — building profiles for advertising, selling to third parties.
Who they target
Browsing behavior, location, purchase history, social connections.
Affects
Virtually everyone who uses free digital services
Core defense
Privacy browsers, ad blockers, VPNs, opting out of data broker records, using aliases for newsletters.
Nation-state actors
Capability: Extremely HighMotivation
Surveillance, intelligence gathering, political control — beyond most people's threat model.
Who they target
Journalists, activists, dissidents, people in authoritarian contexts, high-value targets.
Affects
A small minority of people — but those affected face very high stakes
Core defense
Requires a significantly elevated security posture: encrypted devices, air-gapped computers, encrypted communications, and professional security guidance.
💡 Most people's primary adversary is automated opportunism
Step 3: Assess Likelihood Realistically
One of the most common threat modeling mistakes is assessing likelihood based on fear rather than evidence. People worry about sophisticated nation-state hackers when they haven't yet set up MFA on their email. The anxiety is directed at the dramatic threat, while the mundane threat — which is far more likely to actually cause harm — goes unaddressed.
Likelihood assessment means asking, honestly: given who I am, what I have, who might want it, and what my current security posture looks like — how probable is this threat actually materializing?
Factors that increase likelihood
Reused passwords
A single breach exposes all your accounts using that password. Credential stuffing attacks test breached passwords against hundreds of services automatically.
Public visibility
Being identifiably high-value — publicly announcing wealth, having a large audience, being a public official — increases targeted attack risk substantially.
Outdated software
Known vulnerabilities in unpatched software are actively exploited. Most attacks don't use novel exploits — they use known ones against unpatched systems.
Adversary proximity
Threats from people who know you personally have higher likelihood for specific assets (like your device PIN or relationship history) than from strangers.
Sensitive profession or activity
Journalists, lawyers, activists, healthcare workers, and executives are more likely to be targeted for what they know or do professionally.
Past breaches
If your credentials appeared in previous breaches (check haveibeenpwned.com), the likelihood of credential attacks against you is meaningfully higher.
⚖️ Calibrate, don't catastrophize
Step 4: Evaluate Impact
Likelihood tells you how probable a threat is. Impact tells you how bad it would be if it happened. Together, these two dimensions give you a risk rating for each threat — and a clearer picture of where to focus your energy.
Four dimensions of impact
Financial impact
Low impact
Fraudulent charge, reversible with bank support (< $500)
Medium impact
Account takeover leading to wire transfer or crypto theft ($500–$10k)
High impact
Identity theft enabling loans, tax fraud, or large-scale financial fraud ($10k+, years to resolve)
Privacy impact
Low impact
Advertisers gain more data about your browsing preferences
Medium impact
Personal photos, private messages, or embarrassing content exposed to a limited audience
High impact
Sensitive information (medical, sexual, political) exposed publicly or to people who could use it for coercion
Safety impact
Low impact
Minor personal discomfort or embarrassment
Medium impact
Stalking or harassment enabled by exposed location or contact information
High impact
Physical danger — location exposed to a violent adversary, or disclosure that puts you at legal risk in your country
Professional / reputational impact
Low impact
Minor embarrassment, quickly forgotten
Medium impact
Professional reputation damaged, job loss possible
High impact
Career-ending exposure, legal consequences, business destruction
Risk matrix — likelihood × impact
| Likelihood ↓ / Impact → | Low impact | Medium impact | High impact |
|---|---|---|---|
| High likelihood | Monitor | Address Soon | Priority #1 |
| Medium likelihood | Accept | Monitor | Address Soon |
| Low likelihood | Accept | Accept | Monitor |
Step 5: Choose Your Mitigations
A mitigation is a control — something you do or use that reduces either the likelihood or the impact of a threat. This is where the "what to do" answers live — but only after you've done the thinking above. Mitigations chosen without a threat model are guesswork. Mitigations chosen with one are targeted investments.
Not every risk needs a technical solution. Sometimes the right mitigation is behavioral (not discussing certain topics on certain channels), organizational (keeping certain files offline), or social (limiting who knows certain information about you).
Reduce likelihood
- ›Strong unique passwords remove credential stuffing risk
- ›MFA stops most account takeover attempts
- ›Software updates close known exploit paths
- ›Privacy settings limit data broker collection
Reduce impact
- ›Backups mean ransomware can't hold you hostage
- ›Separate accounts limit blast radius of any single breach
- ›Credit freezes limit identity fraud damage
- ›Encryption makes stolen data unreadable
Accept the risk
- ›Acknowledge the risk consciously rather than ignoring it
- ›Appropriate for low-likelihood, low-impact threats
- ›Or where mitigation cost outweighs the risk
- ›Document what you've decided and why
🔄 Security is iterative, not a one-time event
Common Personal Threat Profiles
Most people fall into one or more of these general profiles. Finding yours gives you a useful starting point — though your actual threat model will be more specific.
The everyday user
FoundationPrimary threats
Credential theft, phishing, account takeover
Usually not a priority
Targeted attacks, nation-state surveillance
Top priorities
- ✓Password manager + unique passwords for every account
- ✓MFA on email and financial accounts
- ✓Software updates on all devices
- ✓Phishing awareness
The remote worker
Foundation +Primary threats
Network interception on public Wi-Fi, device theft, work data exposure
Usually not a priority
Physical surveillance, state-level actors
Top priorities
- ✓VPN on public networks
- ✓Full-disk encryption on work laptop
- ✓Separate work and personal accounts
- ✓Screen lock and physical awareness in public
The small business owner
ElevatedPrimary threats
Ransomware, BEC (business email compromise), client data breach, financial fraud
Usually not a priority
Sophisticated nation-state espionage (usually)
Top priorities
- ✓Offline backups tested regularly
- ✓Email authentication (SPF, DKIM, DMARC)
- ✓Multi-person approval for wire transfers
- ✓Cyber insurance review
The public figure or journalist
HighPrimary threats
Targeted harassment, doxxing, surveillance by hostile state actors, source compromise
Usually not a priority
Automated commodity attacks (still worth defending, just not the priority)
Top priorities
- ✓Hardware security keys for critical accounts
- ✓Encrypted communication for sensitive sources
- ✓Separate identities for public/private life
- ✓Physical security awareness
The person in a difficult relationship
Situation-specificPrimary threats
Intimate partner surveillance, device monitoring, location tracking, account access
Usually not a priority
External hackers are rarely the primary concern
Top priorities
- ✓Audit devices for tracking apps or spyware
- ✓Change all account passwords (from a safe device)
- ✓Review shared accounts and revoke access
- ✓Seek guidance from a domestic abuse support organization if needed
Tools Matched to Threat Levels
The right tool depends on your threat level. Using Signal for every conversation when your threat is opportunistic credential stuffing is overkill that adds friction without proportional benefit. Not using MFA when you're a high-value target is negligence. Here's how to match tools to threat levels.
Foundation — Everyone
Password manager
Bitwarden (free), 1Password, or Dashlane. Unique passwords for every account.
MFA authenticator app
Google Authenticator, Authy, or your phone's built-in. On email and banking first.
Encrypted DNS
Cloudflare 1.1.1.1 or Quad9. Prevents your ISP logging every site you visit.
Privacy browser
Firefox with uBlock Origin, or Brave. Blocks tracking scripts and malicious ads.
Elevated — Remote workers, business owners
VPN
Mullvad or ProtonVPN for public network use. Not a magic shield, but protects traffic from local observers.
Full-disk encryption
FileVault (Mac), BitLocker (Windows). Essential if a device could be stolen.
Encrypted email
ProtonMail or Tutanota for sensitive business communications where you need actual E2EE.
Secure cloud storage
Tresorit or Proton Drive for documents with client or financial data.
High — Public figures, journalists, activists
Hardware security key
YubiKey or similar FIDO2 key. Eliminates phishing risk for critical account logins.
Signal
End-to-end encrypted messaging with disappearing messages for sensitive source communications.
Tor Browser
For research that shouldn't be attributed to your IP address. Slower, but genuinely anonymizing.
Separate devices
Dedicated device for high-sensitivity work, completely isolated from personal accounts and activity.
Your Personal Action Plan
A threat model that never becomes action is just an interesting thought exercise. Here's a structured way to move from analysis to implementation without burning out.
This week
- Write your asset list — what you'd most regret losing or having exposed
- Identify your two or three most likely adversaries
- Check haveibeenpwned.com — if your email is in breaches, change those passwords first
- Enable MFA on your email account
This month
- Install and set up a password manager, migrate your most important accounts
- Enable MFA on banking, work accounts, and social media
- Enable full-disk encryption on your laptop and phone
- Review what apps have access to your location — revoke what's unnecessary
Ongoing
- Review your threat model twice a year or after significant life changes
- Keep all software updated — enable auto-updates where possible
- Audit shared account access annually
- Stay aware of major breaches affecting services you use
🧭 Done is better than perfect
The bottom line
Security isn't about fear.
It's about clarity.
Threat modeling gives you a rational way to answer the question "what should I actually do about security?" — based on your specific life, your specific risks, and your specific tolerance for friction. The goal isn't paranoia. It's making confident, informed decisions about what's worth protecting and what isn't.