Threat Model Lite + Scope Boundaries
Why Most Personal Security Advice Fails Before It Starts
The typical personal security guide jumps straight to tools—password managers, VPNs, two-factor authentication—without asking the prior question: what are you actually trying to protect, and from whom? Without that foundation, you end up either locking down things that don’t matter while leaving real gaps exposed, or building such a rigid system that you abandon it within a month because the friction is unbearable.
Threat modeling is the practice of answering that prior question systematically. The term comes from software security engineering, but the underlying logic applies just as well to an individual protecting their finances, their identity, or their professional reputation. This chapter gives you a streamlined version—enough rigor to make good decisions, without the overhead of an enterprise security review.
The Four Questions That Drive Any Threat Model
A useful threat model doesn’t require a spreadsheet or specialized software. It requires honest answers to four questions, applied to your specific situation.
- What do I have that’s worth protecting? This is your asset inventory. It includes the obvious (financial accounts, login credentials, personal documents) and the less obvious (your email account, which is often the master key to everything else; your phone number, which can be hijacked via SIM swap; your reputation, which can be damaged by leaked private communications).
- Who might want it, and why? This is your threat actor analysis. For most individuals, the realistic adversaries are opportunistic criminals, not nation-states. But your specific circumstances matter—a small business owner faces different risks than a private individual, and a person navigating a contentious legal situation faces different risks than either.
- How likely and how harmful is each threat? This is your risk prioritization. Not every threat deserves equal attention. A phishing email targeting your bank account is both likely and highly harmful. Someone physically breaking into your home to steal your laptop exists on a different probability curve.
- What are you willing to do about it? This is the constraint layer most threat models skip. Security measures that create significant daily friction get disabled or worked around. Your threat model needs to account for your real tolerance for inconvenience, your technical comfort level, and the time you can realistically invest.
Work through these four questions honestly before you touch a single security tool. The answers will shape every decision that follows.
Building Your Asset Inventory
Start by listing what you actually have. People routinely underestimate their digital surface area. A reasonable starting inventory for most individuals includes:
- Financial accounts: bank accounts, investment accounts, retirement accounts, payment apps, credit cards
- Identity documents and their digital equivalents: passport, driver’s license, Social Security or national ID number, tax records
- Login credentials: the email account that receives password resets is especially critical, as is any account connected to financial services
- Devices: laptops, phones, tablets, and anything that syncs to cloud storage
- Cloud storage and backups: where your photos, documents, and communications live
- Professional assets: client data, proprietary work product, confidential communications
- Reputation and relationships: private conversations, sensitive personal information you’d prefer not to become public
Once you have the list, mark each asset with a simple severity rating: high (serious financial or personal harm if compromised), medium (significant inconvenience or recoverable harm), or low (minor impact). This rating doesn’t need to be precise—its purpose is to help you allocate attention later, not to produce a perfect score.
Understanding Your Realistic Threat Actors
Threat actor analysis is where personal threat modeling diverges sharply from enterprise security. Most individuals are not targeted by sophisticated, motivated adversaries with significant resources. Most threats are opportunistic: automated credential-stuffing attacks, phishing campaigns sent to millions of people at once, or criminals who specifically look for unlocked doors rather than picking locks.
That said, your personal circumstances can shift this picture significantly. Consider which of these categories applies to you:
- General population risk: You’re a private individual with no unusual public profile. Your primary threats are opportunistic—automated attacks, broad phishing, and physical theft. Strong basic hygiene addresses the vast majority of your risk.
- Elevated profile risk: You’re publicly visible in some capacity—a local business owner, a professional with an online presence, someone who has been involved in public disputes. You face the same opportunistic threats plus a higher likelihood of targeted social engineering, reputational attacks, and account takeovers by motivated individuals.
- High-stakes situational risk: You’re going through a divorce, a lawsuit, a contentious business dispute, or another high-conflict situation where specific individuals have active motivation to harm you. Your threat model needs to account for adversaries who know you personally and may have partial access to your accounts or devices already.
- Professional handling risk: Your work involves sensitive client data, regulated information, or intellectual property. Your personal security intersects with professional obligations, and a breach of your personal devices may have consequences beyond yourself.
Identify which category or combination applies to your situation right now. It will determine how much complexity your threat model needs to carry.
Scope Boundaries: What This Approach Does and Doesn’t Cover
A clearly scoped threat model is more useful than a sprawling one. The approach in this series is designed for individuals and small business owners who want practical personal security—not for IT professionals managing infrastructure, not for organizations with compliance requirements, and not for people facing nation-state adversaries or advanced persistent threats.
Within that scope, this series covers:
- Credential and account security: how you store, create, and recover passwords and authentication factors
- Device security: keeping your laptops and phones from becoming easy access points
- Communications privacy: understanding which channels are appropriate for what level of sensitivity
- Identity protection: reducing the surface area for identity theft and account takeover
- Behavioral practices: the habits and decisions that underpin every technical measure
What this series explicitly does not cover: advanced operational security (OPSEC) for journalists or activists in high-risk environments, enterprise network security, legal compliance frameworks, or the technical hardening of servers and infrastructure. Those topics are important, but they belong in different resources with different audiences. Trying to cover them here would add noise that makes the practical guidance harder to apply.
Being clear about scope prevents a common mistake: people read about nation-state attack techniques, convince themselves they need to defend against those threats, and either exhaust themselves with overcomplicated measures or conclude the whole project is hopeless and do nothing. Know your scope, defend within it well, and don’t let out-of-scope threats paralyze you.
Mapping Likelihood Against Impact
After building your asset inventory and identifying your threat actors, the next step is to think through which specific scenarios deserve your attention. A simple two-axis mental framework works here: likelihood on one axis, impact on the other.
High-likelihood, high-impact threats deserve your immediate and serious attention. For most people, this quadrant includes credential compromise through phishing or data breaches, account takeover of email or financial accounts, and theft or loss of a phone or laptop. These are the threats most likely to actually harm you, and most of this series is aimed at reducing your exposure to them.
Low-likelihood, high-impact threats deserve basic mitigation but not obsessive focus. Physical home intrusion targeting your devices falls here for most people—serious if it happens, but not a daily probability. Reasonable measures (device encryption, off-site backups, a basic physical security posture) provide adequate coverage without consuming disproportionate effort.
High-likelihood, low-impact threats are often worth tolerating or addressing with lightweight controls. Spam, minor social engineering attempts, and the general noise of living online fall here.
Low-likelihood, low-impact threats can mostly be ignored. No security system addresses every conceivable risk, and attempting to do so is its own kind of failure.
One Honest Constraint: Your Own Behavior
The most overlooked element of any personal threat model is the honest assessment of your own behavior as a variable. Security measures only work if they get used. A password manager you find too cumbersome is worse than a simpler system you’ll actually maintain. Two-factor authentication you disable because it’s inconvenient leaves you more exposed than a well-chosen approach you keep active.
When you design your personal security architecture, build in a realistic assessment of your habits, your technical comfort, the devices you actually use, and the workflows you won’t tolerate disrupting. The goal is a sustainable system calibrated to your real risk—not the most theoretically secure posture you could construct on paper.
Putting It Together: Your Lightweight Threat Model
Before moving to the next chapter, take thirty minutes to work through the following:
- List your significant digital assets and mark each high, medium, or low severity.
- Identify which threat actor category best describes your current situation.
- Write down the three or four specific scenarios you are most realistically worried about—not abstract threats, but concrete ones like “someone phishes my email password” or “I lose my phone with no lock screen.”
- Note any personal constraints that will shape your solutions: technical comfort, time available, devices shared with family members, professional obligations.
This document doesn’t need to be long or polished. Its purpose is to give you a reference point that keeps your subsequent decisions grounded in your actual situation rather than generic advice. Every practical measure in the chapters ahead will be more useful—and more likely to stick—because you did this work first.