Threat model, explained
A threat model identifies what needs protection, who or what may threaten it and which consequences matter.
- The field
- Privacy
- Reading time
- 1 minute
- In this entry
- Meaning · relevance · limits
The meaning
A threat model identifies what needs protection, who or what may threaten it and which consequences matter.
Why it matters
It helps prioritise controls according to likely risks and practical constraints. Revisit it when users, suppliers or the workload change.
The boundary
Trying to defend against every imaginable event can hide the risks that most need attention.
Name an asset and a plausible observer
A community operator wants to protect member contact details from account takeover and public leaks. That goal suggests limiting database access, requiring strong authentication and controlling exports. A different concern, such as traffic observation, needs different measures; a single claim of anonymity does not explain which threat has been addressed.
- List assets, likely adversaries, attack paths and the harm a failure would cause.
- Choose controls and recovery plans for those scenarios, then record the risks that remain.