← Back to glossary
🎯

Threat Modeling

Security

Phishing Incident Response (IR) Security Audit Principle of Least Privilege (PoLP)

Structured analysis of assets, adversaries, attack surfaces, and mitigations to manage risk.

Definition

Threat modeling defines assets (data, accounts), adversaries (criminals, stalkers, advertisers), attack vectors (phishing, tracking, exploitation), and mitigations. Outputs often include prioritized controls and security requirements.

In plain English Structured analysis of assets, adversaries, attack surfaces, and mitigations to manage risk.

Why this matters

Why it matters: Privacy is context-dependent; threat modeling prevents over- or under-protecting by focusing on realistic adversaries and impact.

Example

Example: For a high-risk user, require phishing-resistant MFA, hardened devices, encrypted messaging, and controlled backups; for low-risk users, focus on strong passwords, updates, and privacy settings.