You can't defend against everything, and trying to leads to burnout or theater. Threat modeling focuses your effort by asking a few honest questions.
The questions
- What do I want to protect? (accounts, photos, location, finances)
- Who do I want to protect it from? (scammers, an ex, advertisers, a government)
- How likely is the threat? (be realistic)
- How bad if it fails? (annoying vs life-altering)
- How much effort will I spend? (security you won't keep up isn't security)
Different people, different models
| You | Top threats | Priorities |
|---|---|---|
| Average person | Scams, breaches, ad tracking | Password Managers, 2FA and Passkeys, updates |
| Public figure | Doxxing, harassment | Your Digital Footprint, strict 2FA |
| Activist / journalist | State surveillance | Encrypted Messaging, compartmentalization |
There's no "secure" — only "secure against whom." A model that fits your life beats a paranoid one you'll abandon. Start with the basics that help everyone: a password manager, 2FA, updates, and skepticism.
Related: Your Digital Footprint · Encrypted Messaging · Password Managers