Threat modeling for normal people

Who this is for

Hiii!!! This one is for everyone, honestly, because it's the guide the other guides assume you've read. If you've ever wondered "should I actually be worried about this?" while reading a privacy article, this is for you. You need zero technical knowledge, so don't worry about it. Just ten minutes and a willingness to answer a few questions about your own life. Grab a coffee, I'll wait! :3

The short version

Threat modeling is answering six questions, ideally in writing:

1. What do I want to protect?
2. Who do I want to protect it from?
3. How bad are the consequences if I fail?
4. How likely is it that I need to protect it?
5. How much trouble am I willing to go through?
6. Who are my allies?

Do that once, put a date in your calendar to come back to it, and you get a short list of the threats you actually take seriously. Then every other guide on this blog becomes easier, because you'll know which parts apply to YOU. That's the whole thing, everything else is detail!! :3

How it actually works

Basically, a threat model is a list of the most probable threats to your security and privacy. You can't protect yourself against every possible attacker, so you focus on the most probable ones. EFF's definition is my favorite: it's a way of thinking about the sorts of protection you want for your data, so you can decide which potential threats you're going to take seriously.

The key insight is that trying to protect all your data from everything, all the time, is impractical and exhausting, you'd burn out in a week and give up. A threat model keeps you sane by making trade-offs explicit. And everything here is a trade-off: the more secure something is, the more inconvenient it generally is. There's high security, but never full security. Once you accept that, the whole topic stops being scary!!

Also, your answers are allowed to be boring. "I'm mostly worried about my bank account and my cat Alfonso photos" is a legitimate threat model! Privacy Guides makes this point with a great example: a lawyer in a national security case will go to great lengths to protect their messages, while a mom emailing her daughter funny cat videos doesn't need the same protections. Same tools, totally different models. Neither one is wrong!!

Doing it yourself

Grab a notebook or a text file. Answer in order, keep it short, and DON'T overthink. Ten minutes is plenty!! :3

Step 1: What do I want to protect?

An asset is just something you value. In digital terms: emails, contacts, messages, photos, location history, documents, passwords, and the devices themselves. Write them down, and for each one note where it lives (phone, laptop, some cloud account) and who can already see it.

Step 2: Who do I want to protect it from?

An adversary is whoever might want your stuff, keep it realistic. Common ones are: random scammers and phishers, an ex or a nosy relative, your employer, a thief who steals your laptop, advertisers and data brokers, and possibly the government. It can even include people you trust who might leak your data by being careless with their own security! This list is private, so be honest.

Step 3: How bad are the consequences if I fail?

For each asset, imagine the worst realistic outcome: My email gets taken over, and the attacker resets my other accounts; My laptop gets stolen, and my tax documents are gone; My location history leaks, and someone knows where I live. Then rate each one: catastrophic, annoying, or meh.

Step 4: How likely is it that I need to protect it?

Risk is about likelihood, and it goes hand in hand with capability. Your phone provider has the capability to see your call records, but the risk of them posting those online to ruin your reputation is low. A phishing email aimed at your bank login, on the other hand, is a very real, very common threat!! Cross out what nobody is realistically after, and keep what is both plausible and bad.

Step 5: How much trouble am I willing to go through?

Write down what you'll actually do: maybe a password manager and two-factor authentication, but definitely NOT a homelab and NOT memorizing six random words. That's fine!! Your plan has to survive contact with your actual life, otherwise it's useless.

Step 6: Who are my allies?

The sixth question comes from EFF: who can help? Privacy is a team sport. Your partner, a techy friend, a sibling who also cares, basically people who can watch out for you. Just remember that the people in your life can also be the weak link, so treat this as a reason to talk about security, not to hide from it!!

Step 7: Set a review date

Your situation changes: new job, new house, a breakup, a new bank. Put a reminder in your calendar for six months from now to re-read this list and check whether it still matches your life. EFF also says to mark a date on your calendar to come back to your plan, and six months is just my own rule of thumb!!

What can go wrong

• You try to protect everything. The number one failure mode, seriously. If your plan is "everything, from everyone", go back to Step 4 and be meaner!!
• You copy a whistleblower's threat model. You are NOT Edward Snowden, and that's a GOOD thing. The tools for that level (Tails, Qubes, burner everything) will make your life miserable for threats you don't have. Steal ideas, but do your own homework!!
• You buy tools before doing the thinking. A VPN does not fix a password reuse problem. Model first, tools second!!
• You forget that the boring threats are the real ones. Year after year, the Verizon Data Breach Investigations Report finds the human element in most breaches (62% in the 2026 edition), with phishing and stolen credentials showing up constantly. The 2026 edition also says that exploiting software vulnerabilities is now the most common way in (31%). Keep in mind that the report counts breaches at organizations, not people like us, so I'm borrowing the lesson, not the numbers. For most of us, the highest-value defenses are a password manager, two-factor authentication, AND installing your updates, not exotic software!! I'll write a guide about password managers, phishing, and 2FA soon, but for now, just know that those three things are the most effective defenses for normal people like us.
• You never revisit it. A threat model from last year is stale. Life changes, so the model changes. Set that reminder!!

Where to read more

• EFF: Your Security Plan, the classic walkthrough of the six questions, friendly and thorough.
• EFF glossary: threat model, the one paragraph definition, handy to bookmark.
• Privacy Guides: Threat Modeling, the first stop on their knowledge base, with the trade-off framing and a worked example about protecting your house.
• Privacy Guides: Common Threats, a menu of the threats normal people actually face, great when you're stuck on Step 2.
• Verizon Data Breach Investigations Report, the annual data on how breaches actually happen, to keep your priorities honest.

That's all for now!! I hope this takes some pressure off, honestlyß. Security is a process, not a purchase, and now you have a plan that fits your actual life. Love y'all :3