Personal Threat Modeling

Personal Threat Modeling

Most personal security advice — the DFP Guide, mobile hardening, password managers, MFA — assumes you already know what you’re defending against. You don’t, until you sit down and write it out. The result is people running expensive controls against the wrong threats (a journalist using a Faraday bag while still typing 2FA codes into Signal DMs), or skipping easy controls because they “feel paranoid” (a person being stalked who hasn’t run a data broker opt-out).

This page is a 30-minute exercise to fix that. Do it once, write the output down, revisit when your situation changes.

The four questions

Adapted from the EFF’s framework, with personal-security tuning.

1. What do I want to protect?

List the assets. Be specific — “my data” is not an asset. Examples:

• Bank and brokerage accounts
• The phone number my MFA is tied to
• My personal email account (which controls password resets for everything else)
• My location and travel patterns
• Source identities (for journalists)
• Family member locations
• Communications with specific people (a lawyer, a doctor, a partner, a source)
• A specific Signal/Matrix history
• Photos, especially of children
• Crypto wallet seeds
• Work credentials

Group them by what compromise looks like:

• Financial loss (banking, crypto)
• Identity loss (SSN, credentials, accounts)
• Privacy loss (location, conversations, photos)
• Safety loss (real-world physical harm enabled by a digital leak)

2. Who do I want to protect it from?

List the adversaries. Each one has different capabilities, motivations, and access:

Adversary	Motivation	Typical capability	Typical access
Petty crime / opportunistic	Money	Phishing, credential stuffing, drive-by malware	Public internet, public records
Targeted criminal	Money (you specifically)	SIM swap, social engineering, doxxing, account takeover	Data broker records, breach data, social media
Stalker / harasser	Control, harm	OSINT, social engineering, physical surveillance	Anything that’s publicly searchable about you
Ex-partner / family conflict	Control, leverage	Insider access to shared accounts, devices, physical access	Knows your passwords, your habits, your devices
Employer / corporate	Workplace monitoring, IP protection	Managed-device telemetry, work-account access	Work device, work network, work accounts
Civil opponent (litigation)	Legal advantage	Subpoenas, discovery, OSINT	Provider-level metadata, legal process
Local law enforcement	Investigation	Warrants, subpoenas, device seizure	Provider records, physical device on arrest
Federal law enforcement	Investigation	Above + national security letters, advanced forensics	Above + cellular metadata, content with warrant
Hostile foreign government	Intelligence, harassment	Targeted spyware (Pegasus), CMA phishing campaigns (RIS), border interdiction	Anything they want, given enough effort
Mass surveillance	Data collection	Bulk-collection capabilities	All metadata, much content if unencrypted

You don’t need to defend against everything on this list. Be honest about who’s actually likely to come after you. Most people face the top 3-4 rows; a few face the bottom 3-4.

3. How bad are the consequences if I fail?

For each (asset × adversary) pair, ask: what happens if they get it?

• Recoverable financial loss → annoying but bounded
• Identity theft → 100+ hours of recovery; takes years to fully resolve
• Doxxing → harassment campaign; potentially years of personal-safety impact
• Source identity exposed → potentially fatal for the source
• Location revealed to a stalker → physical-safety event
• Border-stop spyware install → all communications from the past several years readable
• Family member’s location exposed → indirect physical risk to people who didn’t consent to your threat model

The consequence matrix tells you where to spend your defense budget. A recoverable financial loss with full bank-fraud reversal is much less expensive than the time you’d spend hardening against the wrong threat.

4. How much trouble am I willing to go through to prevent each?

This is where most personal-security advice fails. Realistic defenses are ones you’ll actually run for years, not ones that look good in a hardening guide.

• A YubiKey on your laptop is great if you’ll plug it in. If it’ll live in a drawer because you find it annoying, an Authenticator app TOTP is better.
• A burner phone for sensitive conversations is great if you’ll carry it. If it’ll stay home most of the time, your main phone hardened properly is better.
• GrapheneOS is great if your apps tolerate it. If half your daily work breaks, you’ll switch back, and the in-between state is worse than either extreme.
• Daily VPN is great if you’ll keep it on. If you’ll disable it for Netflix and never re-enable it, it’s not protecting you when you need it.

Pick controls you’ll actually keep enabled for years. Match them to the (asset × adversary × consequence) cells where they matter most.

Output: a one-page threat model

Write it down. Re-read quarterly. Update when your situation changes.

PERSONAL THREAT MODEL — [your name] — [date]

TOP ASSETS (in priority order)
  1. <asset> — value: <what compromise costs>
  2. <asset> — ...

REALISTIC ADVERSARIES (in priority order)
  1. <adversary> — likely capability: <...>
  2. <adversary> — ...

THE COMPROMISES I'M MOST WORRIED ABOUT
  - <adversary> getting <asset> would mean <consequence>
  - ...

WHAT I'M DOING ABOUT IT
  - <control> for <adversary × asset>
  - ...

WHAT I'M EXPLICITLY NOT WORRYING ABOUT
  - <threat I'm accepting>: <why I'm not investing here>
  - ...

The “explicitly not worrying about” section is the most useful in practice. Naming what you’re not defending stops the cycle of guilt-driven security spending that drains time without raising your actual safety.

Common personal threat-model patterns

A few realistic profiles to ground the abstraction:

Average professional

• Top adversaries: petty crime, targeted criminal (low likelihood), employer
• Top assets: email account, banking, work credentials, photos
• Right-sized defenses: password manager + unique passwords, passkeys/MFA, email-recovery hardening, data-broker opt-out
• Don’t worry about: targeted spyware, IMSI catchers, border interdiction

Journalist or activist

• Top adversaries: targeted criminal, harassers, civil litigation, hostile state (depending on beat)
• Top assets: source identities, source comms, location, devices on travel
• Right-sized defenses: above + GrapheneOS, secure messaging with safety-number verification, travel DFP, source-handling compartmentalization
• Likely also worth: dedicated burner devices for source meetings, OSINT footprint minimization

Crypto holder / high-net-worth

• Top adversaries: targeted criminal, SIM swap crews, physical robbery
• Top assets: wallet seeds, exchange accounts, banking, identity
• Right-sized defenses: hardware wallet + multi-sig, hardware keys + phishing-resistant MFA everywhere, SIM-swap defenses, no public association between identity and wallet
• Likely also worth: physical-security review (home/office), social-media minimization

Person in family/relationship conflict

• Top adversaries: ex-partner, family member, possibly their hired investigator
• Top assets: location, conversations, custody-relevant evidence, financial independence
• Right-sized defenses: device-level lock-down (shared-account audit, factory reset of shared devices), separate accounts for everything, tracking-device sweep of vehicle and belongings, secure messaging with people they don’t know about
• This is one of the highest-risk-per-effort threat models — small defensive gaps have outsized personal-safety consequences

Person targeted by a stalker

• Top adversaries: the stalker, possibly enabling third parties
• Top assets: location, daily patterns, family member locations, devices for evidence
• Right-sized defenses: data-broker removal, location tracking sweep, secure messaging, separate work+personal devices, documentation for law enforcement
• Document everything for legal use; coordinate with a victim-advocate if available

When to re-run the exercise

• After a job change (new accesses, new adversaries)
• After a relationship change (especially separations)
• After a move
• After a security incident (yours or a close peer’s)
• Annually at minimum

Related

• Digital Force Protection Guide — the controls catalog this exercise prioritizes
• Quick DFP Reference — fast-pick controls list
• Adversary Threats Catalog — what real attacks look like, to inform your adversary list
• Travel DFP — situational threat-model
• EFF Surveillance Self-Defense: SSD project — broader process this page is adapted from