Cybersecurity Foundations (Grades 6–8) · lesson 45 of 48 · 10 min
Thinking Like a Defender — Threat Modeling
Security professionals do not try to defend against every possible attack — that would be impossible. Instead, they use threat modeling: a structured process for identifying what matters most, who might want to attack it, how they might do it, and what you can do to stop them.
Threat modeling is not just for professionals. You can apply it to your own digital life — your accounts, your devices, your data — to make smarter security decisions. It helps you focus your limited time and attention on the defences that matter most for your specific situation.
By the end of this lesson you will be able to apply the five core threat modeling questions, identify your most valuable assets, assess realistic threat actors, and prioritise security controls based on your personal threat model.
Why threat modeling matters
Without threat modeling, security decisions are arbitrary. You might spend hours hardening your Linux server against nation-state attacks while leaving your email account without MFA — even though your email is far more likely to be targeted. Threat modeling ensures your security effort matches your actual risk. It is the difference between security theatre and real protection.
What Is Threat Modeling?
Threat modeling is a structured way of thinking about security risks. Instead of trying to defend against every possible attack, threat modeling helps you identify what you are protecting, who might want to attack it, and what the most likely attack paths are — so you can focus your defences where they matter most.
Professional security teams use formal threat modeling frameworks. But the core questions are simple enough for anyone to apply to their own digital life.
The Five Core Questions
Threat Actors — Who Might Target You?
Realistic threats first
Most students do not need to worry about nation-state attackers. Focus your defences on the realistic threats: opportunistic scammers, credential stuffing from data breaches, and social engineering from people you know. These account for the vast majority of incidents affecting young people.
Building Your Personal Threat Model
Apply the five questions to your own situation. Here is an example for a typical middle school student:
Knowledge Check
Threat Modeling for Students
What is the main purpose of threat modeling?
- To identify every possible attack in the world
- To focus security efforts on the most likely and impactful threats
- To replace antivirus software
- To create a list of all known vulnerabilities
Answer: To focus security efforts on the most likely and impactful threats
Threat modeling prioritises. You cannot defend against everything, so you identify what matters most and focus your defences there.
Which threat actor is MOST likely to target a typical middle school student?
- Nation-state intelligence agency
- Opportunistic scammer using phishing
- Corporate espionage team
- Organised crime syndicate
Answer: Opportunistic scammer using phishing
Opportunistic scammers cast wide nets targeting anyone vulnerable. Nation-states and organised crime focus on high-value targets. Realistic threat modeling focuses on likely threats.
In threat modeling, what is an “attack vector”?
- The motivation of the attacker
- The path or method an attacker uses to reach their target
- The impact of a successful attack
- The asset being protected
Answer: The path or method an attacker uses to reach their target
Attack vectors are the routes attackers take — phishing, password guessing, stolen devices, malicious downloads. Identifying them helps you choose the right defences.
Every person has the same threat model and should use the same security measures.
- True
- False
Answer: False
Threat models are personal. A journalist in a dangerous country has very different threats than a student. Security measures should match your specific assets, threat actors, and risk tolerance.
The five core threat modeling questions start with: What am I protecting? Who might want it? How could they get it? What happens if they get it? And: What can I _____ about it?
Answer: do
The fifth question leads to mitigations — the controls and actions you take to reduce risk. Without this step, threat modeling is just a list of worries.
Real-World Case Studies
Case 1: The Journalist’s Threat Model — Why Context Matters
Eva Galperin, Director of Cybersecurity at the Electronic Frontier Foundation, works with journalists and activists in dangerous countries. A journalist in Turkey covering government corruption has a very different threat model than a student in the US. Their threat actors include state intelligence agencies with nation-state capabilities. Their defences must include encrypted communications, operational security, and physical security. The lesson: threat modeling is personal. The right security measures depend entirely on who you are, what you are protecting, and who might want it.
Case 2: The Theranos Threat Model Failure
Theranos, the fraudulent blood-testing company, had a threat model that focused entirely on external attackers and competitors — but completely ignored the insider threat of employees who knew the technology did not work. Whistleblowers eventually exposed the fraud. The lesson: threat modeling must consider all threat actors, including insiders. A company that only defends against external hackers while ignoring internal fraud, whistleblowers, or disgruntled employees has an incomplete threat model.
Previous lesson: Team communication during incidents
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Encryption in everyday life