Define Your Threat Model

A threat model is a written answer to three questions: what am I protecting, from whom, and what happens if I fail? It is not a document you publish. It is a short note that stops you from buying the wrong tool.

The three questions

What am I protecting? A device, an account, a relationship, a document, your physical safety, your right to say something. “My privacy” is not an answer, because it does not imply a single control.

From whom? Name a category, and be honest about capability:

Adversary	Typical capability	Realistic goal
Automated crawlers	Your browser fingerprint, IP address, cookies	Stop fingerprinting, block third parties
Data brokers	Records bought and sold legally	Opt out, reduce footprint, avoid new disclosures
A curious network	Sees DNS, TLS SNI, timing, volume	Encrypted DNS, encrypted transport, Tor
A service you depend on	Sees everything you do on its platform	Minimise what you give it
A targeted attacker	Phishing, malware, persistent access	MFA, updates, backups, compartmentalisation
A state actor with legal process	Subpoenas, warrants, bulk programmes	Compartmentalisation, encryption, Tor, reducing what exists
A physical attacker	Your unlocked device	Full-disk encryption, screen lock, remote wipe

What is failure? If the answer is “someone reads my messages”, the control is encryption. If it is “someone follows me home”, the control is different. If it is “I cannot log in”, the control is a recovery method you have tested.

Assets, adversaries, capabilities, exposure

The four columns work for almost anything:

• Asset — the thing: a specific account, a device, a location pattern, a set of files.
• Adversary — who wants it, from the table above.
• Capability — what they can reach: your device only, your accounts, your network path, a legal order, a supply chain.
• Exposure — how they get in: phishing, a reused password, an unpatched browser, a plaintext file, a rogue USB device, a shared document.

Then, for each combination, a decision: accept, reduce, transfer, or avoid. Accepting a risk explicitly is a legitimate outcome; it is what stops you from spending a week on a threat you will never meet.

Review it, and keep it in the repository

Threat models go stale the moment your life changes: a new job, a new city, a new device, a new dependency. Keep it in your notes or your repository next to the thing it describes, and revisit it when any of those change.

Sources

• EFF Surveillance Self-Defense, Your Security Plan — a step-by-step method for personal security, freely available.
• NIST SP 800-30 Rev. 1 — the standard risk-assessment vocabulary, if you want the formal version.
• OWASP Threat Modeling Cheat Sheet — aimed at software, useful for the asset/entry-point decomposition.

Next: common threats, and which of them are worth doing anything about.