Threat modeling means deciding what you need to protect, who you need to protect it from, and how much effort that deserves. It’s the step that tells you whether a tool, setting or habit is worth your time before you spend any.
Without it, people tend to fall into one of two traps. Some do nothing because security feels endless. Others chase every warning and burn out. The Electronic Frontier Foundation (EFF) calls trying to protect all your data from everything all the time impractical and exhausting. A threat model narrows the job to the threats that apply to you.
After this page you’ll be able to write a one-page plan, and you’ll see why two sensible people can reach different decisions about the same tool. It doesn’t recommend specific tools. Those pages assume you’ve done this first.
What threat modeling is in plain terms
In computer security, a threat is a potential event that could undermine your efforts to defend your data. A threat model is the short list of threats you’ve decided to take seriously, plus what you’ll do about each one. The EFF calls the same process a security plan.
Professionals use the same idea at a larger scale. OWASP, a non-profit focused on software security, describes threat modeling as a way to identify, communicate and understand threats and the ways to reduce them. It applies to anything of value, from software and networks to business processes. The Threat Modeling Manifesto, written in 2020 by a group of practitioners and researchers, describes it as analysing a representation of a system to find security and privacy concerns. The scale changes but the questions don’t.
The EFF’s starter example is a house. If your possessions are valuable and break-ins are common where you live, a better lock and an alarm make sense. If break-ins are rare, spending heavily on locks doesn’t. The same reasoning works for passwords, phones and accounts.
Four terms you’ll see
| Term | What it means | Example |
|---|---|---|
| Asset | Something you value and want to protect, usually information | Your email, contacts, messages, location, documents, and the devices holding them |
| Adversary | A person or group that poses a threat to an asset | A former partner, a hacker on public Wi-Fi, an employer |
| Threat | A potential event that could undermine your protection | Someone logs in to your email with a password leaked from another site |
| Risk | How likely a particular threat against a particular asset is to happen | A leaked password being tried on your email is likely, but a phone company publishing your records is not |
The EFF defines risk as that likelihood. NIST, the US standards body, uses a formal definition that also weighs the impact if the threat occurs. We use both together, and the questions below ask how likely a threat is and how bad it would be.
How to build a threat model
The EFF’s security plan has six questions. Answer each in a sentence or two. The order isn’t fixed, and you’ll often jump back to an earlier answer.
What do I want to protect?
Make a list of your assets. For most people that means information: emails, contacts, messages, location, documents. The devices themselves count too. We’d add the accounts that give access to all of it. For each asset, note where it’s kept, who has access and what currently stops others from getting in.
Who do I want to protect it from?
The EFF’s examples of adversaries include a boss, law enforcement, a former partner, a business competitor, a government and a hacker on a public network. It also includes trusted people who might compromise your assets by being careless with their own security.
Most people’s likeliest adversary is far less dramatic than a government. In a year-long study of Google account hijacking with researchers at New York University and the University of California, San Diego, most attacks came from automated bots using passwords leaked in breaches of other sites. Phishing and targeted attacks were also present but less common.
How bad are the consequences if I fail?
Think about what an adversary could do with the asset. They could read it, delete it or use it against you. The EFF’s examples run from a malicious link that compromises a computer to someone screenshotting your private messages. Ask whether you could replace what’s lost and whether other people would be affected too.
Consider the adversary’s capability. Your mobile provider can see your call records, and a stronger adversary may reach much further.
How likely is it that I will need to protect it?
Capability and likelihood are different things. Your mobile provider can see all your records, but the chance of it publishing them to hurt you is low. The EFF compares a building collapsing: possible anywhere, but far likelier in an earthquake zone like San Francisco than in Stockholm.
This judgement is personal. The EFF notes that some people reject a threat at any likelihood because it’s not worth the cost, while others ignore high risks because they don’t see them as a problem. Write down which threats you’ll take seriously and which are too rare, too harmless or too hard to fight.
How much trouble am I willing to go through?
There’s no perfect option. The EFF’s example is an attorney handling a sensitive national security case, who may accept far more inconvenience than a relative who emails cat videos. Your answer should account for money, time, technical skill and the people around you.
Who are my allies?
Privacy and security overlap with those of people around you, so a threat to you often reaches them too. The EFF suggests agreeing with people who share your concerns on how you’ll look after each other and what you’ll trust each other with. It also reminds you that someone in your trusted circle could be an insider threat, and says that shouldn’t stop you building those connections.
One asset, three plans
The same asset can need very different protection. Here are three illustrative people, each worried about their main email account.
| Priya, a freelance translator | Daniel, a reporter covering local corruption | Mei, who has left a controlling partner | |
|---|---|---|---|
| Likeliest adversary | Automated bots and bulk phishing | A determined attacker sending convincing, personalised messages | Someone who already knows her habits and may know her passwords |
| What failure costs | Lost client files and income | Exposed sources and personal safety | Safety and privacy at home |
| Effort worth spending | A modest amount, applied everywhere | More money and inconvenience | Specialist help, not only a checklist |
The plans differ because the adversaries differ, not because one person cares more. The Google study shows why this matters in practice. An SMS code sent to a recovery phone blocked all the automated bots, 96% of bulk phishing and 76% of targeted attacks. On-device prompts blocked 100%, 99% and 90%. No user who relied only on security keys fell victim to targeted phishing during the study. That data covers Google accounts in 2019, so it won’t transfer exactly to other services or to today’s attacks. The pattern still holds. Priya’s risk is mostly the first kind of attack, and Daniel’s is closer to the last.
Those figures describe attackers who have to break in. They say much less about someone who already knows your passwords or can pick up your phone, which is Mei’s situation. If that’s you, a domestic violence service with technology-safety expertise can help with both your safety and your devices. General tips can’t replace that.
To write your own, pick one asset, such as your main email account, and answer the six questions in a sentence each. Keep the page somewhere private. The EFF points out that a list of adversaries may be something you want to destroy once you’ve finished.
What threat modeling can’t do
- It doesn’t produce perfect safety. The EFF is direct that there’s no perfect option, only a reasonable plan for your situation.
- It’s only as good as what you know. If you have reason to believe a determined person or group is targeting you, a self-made plan isn’t enough and you should talk to a specialist organisation.
- It can’t reach data other people hold about you. Companies and agencies keep records on you, and leaks from those systems are outside your plan. Why privacy matters covers that problem.
- It can go wrong by focusing too narrowly. The Threat Modeling Manifesto warns against exaggerating attention on adversaries, assets or techniques and losing sight of the whole picture.
One more note on method. Adam Shostack’s four-question frame (what are we working on, what can go wrong, what are we going to do about it, did we do a good job) is the standard in professional work. He says it was designed for people building systems and works less well for end users. That’s why this page uses the EFF’s plain-language version instead.
Common myths
“Threat modeling is for spies and activists”
The Manifesto answers its own question about who should threat model with “you” and “everyone”. The EFF’s own starter example is a house and a lock, not a state adversary.
“The most secure option is always the best”
Stronger protection usually costs more money, time or convenience, and the EFF says plainly that nobody gets a perfect option. The best option is the one you’ll keep using against the threats you actually face.
“I have to plan for every possible attacker”
OWASP says that trying to evaluate every combination of attacker, attack, weakness and impact is often a waste of time and effort. Narrowing the search to the threats that matter to you is the point of the exercise.
When to redo it
Your threat model describes your life at one moment, and your life changes. The EFF says to revisit your plan regularly and suggests putting a review date in your calendar. OWASP advises updating a model after events such as a new feature or a security incident. For a person, the equivalent might be starting a new job, ending a relationship, becoming publicly visible or buying a new device. Those are our examples, not the EFF’s.
Sources
- Your Security Plan, Electronic Frontier Foundation (Surveillance Self-Defense), last reviewed October 2023.
- Threat Modeling, OWASP Foundation, accessed October 2026.
- Threat Modeling Manifesto, Threat Modeling Manifesto working group, 2020.
- Shostack’s Four Question Frame for Threat Modeling, Adam Shostack, accessed October 2026.
- Risk (glossary entry), National Institute of Standards and Technology, accessed October 2026.
- New research: How effective is basic account hygiene at preventing hijacking, Google Security Blog, 2019.