Personal Threat Model

A personal threat model assesses what you're protecting (assets), who might want it (adversaries), how they might get it (attack vectors), consequences of compromise (impact), and proportionate protections (countermeasures). The EFF's five questions: What to protect? From whom? How likely? How bad if compromised? How much trouble to prevent? Security is contextual: appropriate measures for a political dissident differ from an average professional. Over-securing wastes effort; under-securing creates risk. The framework ensures security investments match actual risk profiles rather than defaulting to either paranoia or complacency.

When to use it

When deciding which security measures are worth implementing. When evaluating whether your current security posture matches your risk level. When onboarding to a new role with different security requirements. When advising others on personal security without defaulting to either paranoia or complacency.

How it can help

Most professionals need moderate security: password manager + 2FA, updated devices, caution with public WiFi, social engineering awareness. High-profile individuals need enhanced measures: hardware security keys, encrypted communications, minimal social media. The framework prevents security nihilism ('why bother') and security theater ('VPN for grocery lists'). For entrepreneurs handling customer data, this applies to organizational security posture—proportionate protection based on actual threats.