Cyber Academy
Threat modelling for individuals
Deciding what you are actually protecting and from whom, so effort goes where it changes the outcome.
Generic security advice assumes a generic person. Threat modelling replaces that with four specific questions about your own situation, and the answers usually shift priorities substantially.
The four questions
- What do I want to protect? Money, private communications, professional reputation, physical location, someone else's data.
- Who wants it? Opportunistic criminals, a specific individual, an employer, an abusive partner. These require very different defences.
- How bad is failure? Recoverable inconvenience or serious harm.
- How much effort am I willing to sustain? A plan you abandon protects nothing.
Why the adversary matters most
Defending against automated credential stuffing is mostly about unique passwords and a second factor. Defending against someone who has physical access to your devices and knows your recovery answers is an entirely different problem, where device access, account recovery paths, and location metadata dominate.
Most advice online implicitly assumes the first case. If your situation is the second, prioritise accordingly and consider specialist support.
Revisit it
A threat model is a snapshot. Changing jobs, ending a relationship, becoming publicly visible, or starting to handle other people's data all change the answers. Review it when your circumstances change rather than on a schedule.