Loading module…
Loading module…
Module 1 of 6
Most people think about their personal security, if they think about it at all, in one of two broken ways. The first is denial: nothing bad has happened to me, bad things happen to other people, and I do not need to think about this. The second is anxiety: the world is dangerous, threats are everywhere, and the appropriate response is a diffuse, exhausting vigilance that never resolves into anything useful. Both are failures of the same kind — a failure to model one's actual threats accurately — and both produce bad outcomes. The person in denial is unprepared for the threats that genuinely apply to them. The anxious person burns enormous energy on vigilance while remaining, paradoxically, no safer, because undirected worry does not translate into effective protection. Neither has done the one thing that actually produces security: figured out what specifically threatens them, and matched their precautions to it.
This is threat modeling, and it is the foundation on which all of personal security rests. A threat model is a clear-eyed answer to four questions: what am I trying to protect, who or what realistically threatens it, how capable and motivated are those threats, and what is the cost and benefit of protecting against each one. It is the difference between security as an anxious feeling and security as a rational discipline. Without a threat model, every security decision is a guess — you buy the alarm system a salesman scared you into, you worry about the dramatic threats the news amplifies, and you ignore the mundane ones that are far more likely to actually harm you, because you have no framework for telling the real threats from the imagined ones. With a threat model, security becomes tractable: you know what you are defending against, you can tell whether a given precaution addresses a real threat or a phantom one, and you can spend your finite time, money, and attention on the protections that actually matter for your actual life.
This module builds personal threat modeling from the ground up, and it does so in the spirit that governs this entire domain: security is protective, proportionate, and rational. The purpose is to help you protect yourself and the people you are responsible for, matched honestly to the threats you genuinely face — not to make you fearful, not to make you see danger where there is none, and not to sell you protection against threats that do not apply to you. The person with a good threat model is, in a deep sense, less anxious than the person without one, because they have replaced diffuse worry with specific knowledge, and specific knowledge is manageable in a way that diffuse worry never is. Threat modeling is how you convert the overwhelming, formless question "am I safe?" into the answerable, actionable question "what specifically threatens me, and what should I do about it?" — which is the only version of the question that leads anywhere useful.
Begin with precision about the concept, because "threat model" is used loosely and the looseness hides the discipline that makes it valuable. A threat model is a structured description of the threats that apply to a specific person or asset, capturing enough about each threat to decide how much to worry about it and what to do. It is specific — a threat model is always for someone in particular, because threats that are serious for one person are irrelevant for another, and a generic "list of dangers" is not a threat model precisely because it is not tied to a specific person's actual situation. It is structured — it does not merely list dangers but characterizes each one along the dimensions that determine how to respond: what it targets, how likely it is, how much harm it could do, how capable and motivated the source is. And it is decision-oriented — the point of building it is to make better security decisions, so a threat model that does not change what you do is not doing its job.
The four questions that structure a threat model are worth stating carefully, because each one does distinct work. What are you protecting? — the assets, which for personal security include your physical safety and that of the people you are responsible for, your property, your freedom of movement, your privacy, and your ability to continue your normal life undisrupted. Naming the assets matters because different assets face different threats and warrant different protections; the measures that protect your physical safety are not the same as those that protect your property, and lumping them together as "being safe" prevents you from seeing that they need different responses. Who or what threatens each asset? — the threat sources, which range from impersonal (accidents, natural events, opportunistic crime) to personal (someone with a specific reason to target you). Distinguishing these matters enormously, because an impersonal threat and a targeted threat call for completely different defenses, as later sections will develop.
How capable and motivated is each threat source? — because a threat is dangerous only in proportion to the source's ability to carry it out and their reason to try. A source with high capability and high motivation is a serious threat; a source with high capability but no motivation to target you, or high motivation but no capability, is much less so. This dimension is what separates the threats worth defending against from the ones that are theoretically possible but practically irrelevant — the theoretically-possible threat with no motivated, capable source behind it is exactly the phantom that anxiety fixates on and that a good threat model dismisses. What does protection cost, and what does it buy? — because every protection has a cost in money, time, convenience, and freedom, and a protection whose cost exceeds the harm it prevents is a bad trade even if it works. This dimension is what prevents threat modeling from spiraling into the anxious over-protection that treats every possible threat as worth any cost to prevent.
Put the four questions together and a threat model becomes a tool for triage — for sorting the vast space of possible dangers into the few that warrant your attention and resources and the many that do not. This triage function is the entire value of the exercise. The world contains an effectively infinite number of things that could theoretically harm you, and you cannot defend against all of them; you have finite money, time, and attention, and spending them on the wrong threats leaves you exposed to the right ones. The threat model tells you which threats are real for you — likely enough, harmful enough, and backed by a capable enough source — to be worth defending against, and which are not, so that your finite protective resources go where they actually reduce your risk. A person without this triage defends against the threats that feel scary (which the media and their own imagination select for drama, not for actual likelihood) and neglects the threats that are boring but real. A person with it defends against the threats that are actually likely to harm them, which are frequently not the dramatic ones at all.
A worked contrast makes the triage concrete. Consider two people building a threat model for their physical safety. One is a suburban professional with an ordinary job and no enemies; the other is a person who has left an abusive relationship and whose former partner has threatened them. For the first person, the realistic threats are impersonal and low-probability: an opportunistic burglary while away, an accident, a random encounter with a stranger — and the appropriate protections are ordinary and inexpensive (reasonable locks, basic situational awareness, the mundane precautions everyone should take). Deep security measures would be wasted on them, because no capable, motivated source is targeting them specifically. For the second person, the threat model is entirely different: a specific, motivated, possibly capable source is targeting them, the probability is elevated, the potential harm is severe, and the appropriate protections are correspondingly serious — pattern disruption, information control, possibly legal and law-enforcement engagement, all of which the first person would be foolish to invest in. Same asset (physical safety), completely different threat models, completely different appropriate responses — and the only way to know which response is right is to have modeled the actual threats to the actual person. This is why generic security advice is so often useless: it cannot know your threat model, and the right protection depends entirely on it.
Key Insight: A threat model is a structured, person-specific, decision-oriented description of your actual threats, built from four questions: what you protect (your assets), who or what threatens each, how capable and motivated each source is, and what protection costs versus what it buys. Its value is triage — sorting the infinite space of possible dangers into the few real enough to warrant your finite protective resources and the many that do not. The same asset produces completely different threat models and completely different right answers for different people, which is exactly why generic security advice fails.
The first question — what are you protecting? — seems trivial and is not, because most people have never actually enumerated their assets and therefore protect some while unconsciously neglecting others. Making the asset list explicit is the necessary first step, because you cannot assess threats to something you have not named, and the assets people forget to name are exactly the ones they end up failing to protect. This section builds the personal-security asset list carefully, because the completeness of the list determines the completeness of everything downstream — a threat to an unnamed asset is a threat you will never model and never defend against.
The most fundamental asset is physical safety — your body's integrity and that of the people you are responsible for, freedom from violence, injury, and harm. This is the asset personal security most centrally protects, and it is the one people most reliably name, though even here there is a subtlety: physical safety includes not only freedom from deliberate violence but freedom from the accidents and environmental hazards that are, for most people most of the time, a far larger threat to their bodies than any attacker. A threat model focused only on violence, ignoring the mundane physical dangers, is incomplete — the stairs, the road, the environmental hazard threaten physical safety too, and for the average person threaten it more than an assailant does. Naming physical safety as the asset, rather than narrowly naming "protection from attackers," keeps the mundane and statistically-dominant threats in view alongside the dramatic ones.
The second asset is property — your possessions, your money, your home and vehicle, the physical things whose loss or damage would harm you. Property is a distinct asset from physical safety because it faces different threats and warrants different, generally lesser, protections — the loss of property is recoverable in a way that physical harm often is not, which means property generally deserves less protective investment than safety, and confusing the two leads people to take physical risks to protect property (confronting a burglar, chasing a thief) that a clear asset-hierarchy would forbid. A good threat model ranks the assets, and physical safety ranks above property, which has the important practical consequence that you should never trade the higher asset to protect the lower one — never risk your body to save a possession, because the asset hierarchy says the body is worth more.
The third asset, often unnamed and therefore often neglected, is freedom of movement and normal life — your ability to go where you need to go, do what you need to do, and live without disruption or the constant modification of your behavior around a threat. This asset is subtle because its loss is gradual and self-imposed: the person under threat who stops going out, who reorganizes their whole life around avoiding danger, who trades away their freedom for a feeling of safety, has lost an asset even if no attacker ever touches them. Naming freedom of movement as an asset is what prevents the over-protection failure — the recognition that security measures which destroy your normal life are not costless, that they consume a real asset (your freedom to live) in the name of protecting others, and that a security posture which leaves you safe but unable to live a normal life has failed to protect one of the things that mattered. This asset is the counterweight that keeps threat modeling from collapsing into the anxious over-vigilance that sacrifices everything for safety.
The fourth asset is information and privacy — the personal information whose exposure could enable a threat, from your location and routines to the details that a motivated adversary could use to target you. Information is an asset because it is a precursor to other threats: an adversary who knows where you live, when you are away, what your routine is, and who is close to you is far more capable of harming your physical safety and property than one who does not, which means protecting your information protects the other assets upstream. The information asset connects personal security to the privacy and data-footprint concerns of the broader curriculum, and it is increasingly central because so much personal information is now exposed by default through digital life, giving even low-capability adversaries access to targeting information that once required real effort to obtain. Naming information as an asset is what brings the digital dimension of personal security into the physical threat model, where it belongs, because in the modern world the physical threat is very often enabled by the informational exposure.
The discipline of the asset list is completeness and hierarchy: name all the assets, including the easily-forgotten ones (freedom of normal life, information), and rank them so that when protections trade off against each other you know which asset wins. The complete, ranked asset list is the foundation of the whole threat model, because every subsequent question — who threatens this, how capable are they, what should I do — is asked of a specific asset, and an asset you failed to name is an asset whose threats you will never assess and whose protection you will never plan. Most personal-security failures that trace to threat modeling trace to this first step: not to a mis-assessment of a named threat, but to a whole asset that was never named and therefore never protected, most often the freedom-of-normal-life asset sacrificed to over-vigilance or the information asset left exposed because it was never recognized as an asset at all.
Key Insight: You cannot protect an asset you have not named, and the assets people forget to name are the ones they fail to protect. The personal-security asset list has four members: physical safety (including the mundane and statistically dominant accident and hazard risks, not just violence), property (recoverable, so ranked below safety — never trade the body to protect a possession), freedom of movement and normal life (whose gradual self-imposed loss to over-vigilance is a real cost), and information/privacy (the upstream precursor that enables threats to the other assets). Name all four and rank them, because every downstream question is asked of a specific asset.
With the assets named, the second question asks who or what threatens each — and the single most important distinction in all of personal threat modeling is the distinction among three kinds of threat source, because each kind behaves completely differently and calls for a completely different defense. Getting this distinction right is what separates effective personal security from the generic, one-size-fits-all vigilance that defends against the wrong kind of threat. The three kinds are impersonal threats, opportunistic threats, and targeted threats, and they differ along the crucial dimension of whether anyone is choosing you specifically — which turns out to determine almost everything about how to defend.
Impersonal threats are dangers with no agent choosing you at all: accidents, environmental hazards, natural events, the random physical dangers of ordinary life. These threats do not care who you are, cannot be deterred, and do not adapt to your defenses — the icy road, the house fire, the medical emergency threaten you not because anything selected you but because you were present when the hazard manifested. Impersonal threats are, for the statistically average person, by far the largest category of threat to physical safety, and they are the category that dramatic security thinking most neglects, because they lack the villain that captures attention. The defense against impersonal threats is entirely different from the defense against agents: you cannot deter an accident or outmaneuver a fire, so you defend by reducing exposure (not being where the hazard is), by hardening against the hazard (the smoke detector, the seatbelt, the safe practices), and by preparing to respond (the emergency plan, the first-aid capability). A threat model that includes impersonal threats — as it must, because they are the largest category for most people — directs a large share of protective attention to these mundane, deterrence-immune, high-probability dangers, which is exactly where it should go and exactly where dramatic security thinking fails to send it.
Opportunistic threats are agents who will harm you if you present an easy opportunity, but who did not select you specifically and will move on if you are not an easy target. The opportunistic criminal — the thief looking for an unlocked car or an unattended bag, the burglar looking for an empty house with poor security, the mugger looking for a distracted, isolated victim — is choosing a situation, not a person. They want a target, any target, that offers a good ratio of reward to risk, and you become their target by being the easiest available one, not by being you. This changes the defense fundamentally: because the opportunistic threat is choosing ease rather than choosing you, you defend not by becoming invulnerable but by becoming less easy than the alternatives — the opportunist who finds your car locked moves to the unlocked one, who finds you alert moves to the distracted person, who finds your house secured moves to the unsecured one. Defense against opportunistic threats is comparative and deterrent: you do not have to be impregnable, only harder than the next option, because the opportunist's defining trait is that they will take the easier target and there is almost always an easier target than a person taking basic precautions. This is why basic, unglamorous security measures are so effective against the most common criminal threats — they do not defeat a determined attacker, but the opportunist is not determined, and against them merely not being the easiest target is most of the defense.
Targeted threats are agents who have chosen you specifically and have a reason to harm you in particular: the abusive former partner, the person with a specific grievance, the stalker fixated on you, the adversary who has selected you as their objective. The targeted threat is categorically more dangerous than the opportunistic one, because the targeted threat does not move on to an easier victim when you harden your defenses — you are the objective, so they adapt, persist, and work around your protections rather than abandoning them for someone easier. This is the crucial difference: the opportunist is deterred by making yourself harder than alternatives, but the targeted adversary has no alternatives that satisfy them, so hardening merely raises the effort they must invest, without redirecting them elsewhere. Defense against a targeted threat is therefore an entirely different and more serious undertaking than defense against an opportunist — it requires assuming an adaptive adversary who studies you, works around static defenses, and persists over time, which calls for the pattern-disruption, information-control, and often legal and law-enforcement measures that the later modules develop and that would be wildly disproportionate against a merely opportunistic threat.
The reason this three-way distinction is the master concept of personal threat modeling is that almost every failure of personal security comes from applying the defense for one kind of threat to another kind. Applying opportunistic defenses (harden, deter, be less easy than alternatives) to a targeted threat is a catastrophic error, because the targeted adversary is not deterred by being made to work harder — they adapt, and the victim who thinks "I locked my doors, I'm safe" against a determined targeted threat has profoundly misjudged the situation. Applying targeted-threat defenses (assume an adaptive persistent adversary, disrupt your patterns, control your information, restructure your life) to a merely opportunistic or impersonal threat is the over-protection error, burning enormous resources and sacrificing the freedom-of-normal-life asset against a threat that basic precautions would have handled. And neglecting impersonal threats entirely, in favor of the dramatic agent-threats, leaves the largest actual category of danger — the accidents and hazards — unaddressed. Correctly identifying which kind of threat source applies to each of your assets is the pivot on which the entire threat model turns, because it determines which entire family of defenses is appropriate, and getting the family wrong wastes all the effort within it.
Key Insight: The master distinction in personal threat modeling is among three threat sources defined by whether anyone chose you specifically. Impersonal threats (accidents, hazards) select no one, cannot be deterred, and are the largest category for the average person — defend by reducing exposure, hardening, and preparing to respond. Opportunistic threats choose a situation not a person and move to an easier target — defend by being harder than the alternatives, which basic precautions accomplish. Targeted threats chose you and will adapt around static defenses rather than move on — defend by assuming an adaptive persistent adversary. Almost every security failure comes from applying one family's defenses to another family's threat.
Identifying a threat source is not enough; you must assess how dangerous it actually is, and a threat's danger is the product of two factors — how capable the source is of harming you and how motivated they are to try. Both must be present for a threat to be serious: a highly capable source with no motivation to target you is not a real threat, and a highly motivated source with no capability to reach you is not a real threat either. Assessing capability and motivation honestly is what separates the threats worth defending against from the theoretically-possible ones that anxiety inflates, and it is the dimension where fear most distorts the threat model, because fear systematically overestimates both factors for dramatic threats and underestimates them for mundane ones.
Capability is the source's actual ability to carry out the threat against you specifically — their skills, resources, access, and reach. Capability assessment is where much anxiety-driven over-estimation happens, because people imagine adversaries with near-unlimited capability (the criminal mastermind, the untraceable stalker, the sophisticated attacker) when real threat sources are usually far more limited. The opportunistic criminal has low capability — limited skills, limited resources, deterred by modest defenses — which is exactly why modest defenses work against them. Even many targeted threats have bounded capability: the former partner may be motivated but not skilled at circumvention, the aggrieved acquaintance may lack the resources to mount a serious campaign. Assessing capability honestly means asking what this source can actually do — not what a maximally capable version of them could do, but what this particular source, with their real skills and resources, is realistically able to accomplish against your real defenses. Overestimating capability leads to the over-protection error (defending against a super-adversary who does not exist); underestimating it leads to the under-protection error (dismissing a threat that is more capable than it appears, which is the specific danger with a determined targeted adversary who may develop capability over time).
Motivation is the source's actual reason and drive to target you specifically, and this factor is what most sharply distinguishes the three threat types. Impersonal threats have no motivation at all — the hazard does not want anything — which is why they cannot be deterred but also why they do not adapt. Opportunistic threats have low, general motivation — they want a target but not you in particular, so their motivation is easily redirected to an easier victim, which is the entire basis of deterrence against them. Targeted threats have high, specific motivation — they want you, for a reason particular to you, and this motivation does not redirect, which is what makes them persist and adapt. Assessing motivation means asking honestly whether anyone actually has a specific reason to target you, and resisting both errors: the anxious error of imagining specific enemies where none exist (the person with an ordinary life who fears a targeted campaign that no one has any reason to mount), and the denial error of dismissing a real motivated adversary (the person who minimizes the threat from someone who has actually threatened them, because acknowledging it is frightening). Motivation is often the more assessable of the two factors because it is usually more knowable — you generally know whether someone has a specific grievance against you, has threatened you, or has a reason to want to harm you — and it is the factor that most reliably separates the serious targeted threat from the phantom.
The two factors combine multiplicatively, which has an important consequence: a threat is serious only when both capability and motivation are meaningfully present, and a threat that is high on one factor but near-zero on the other is not a serious threat regardless of how high the one factor is. The capable source with no motivation to target you (the vast majority of dangerous people in the world, who have no reason to care about you specifically) is not your threat. The motivated source with no capability to reach you (the distant adversary who wishes you ill but cannot act) is not your immediate threat. This multiplicative structure is precisely what triage requires — it identifies the small set of threats that are high on both factors as the ones warranting real defensive investment, and dismisses the large set that are high on only one, which is where anxiety's phantoms live. The phantom threat is almost always one that is high on a factor that fear amplifies (usually a vividly imagined capability) but near-zero on the other (no actual motivated source), and recognizing the near-zero factor is what dissolves the phantom.
A discipline of honest assessment must confront the two-sided distortion that fear introduces, because fear does not distort uniformly — it inflates the assessment of dramatic, vivid, media-amplified threats and deflates the assessment of mundane, familiar ones. The dramatic stranger-attack, the sophisticated intruder, the sensational crime is assessed as more capable and more likely than it is, because it is vivid and frightening and the mind overweights the vivid. The mundane threats — the accident, the far-more-common crime committed by someone known to the victim rather than a stranger, the boring hazard — are assessed as less threatening than they are, because they are familiar and un-dramatic and the mind underweights the boring. This systematic distortion means that a threat model built on unexamined fear will be almost exactly wrong: over-defended against the dramatic-but-rare and under-defended against the mundane-but-common. The corrective is to assess capability and motivation deliberately and factually, against what is actually known about how threats to people like you in situations like yours actually manifest, rather than against the vivid images that fear supplies — which is why the next module turns to reading the actual environment, and why honest, fact-based threat assessment is the antidote to both the denial and the anxiety that this module opened by diagnosing.
Key Insight: A threat's danger is capability times motivation, and both must be meaningfully present — a capable source with no reason to target you and a motivated source who cannot reach you are both non-threats, which is where anxiety's phantoms live (high on a fear-amplified factor, near-zero on the other). Assess capability by what this source can actually do, not what a maximal version could; assess motivation by whether anyone has a specific reason to target you. Fear distorts two-sidedly — inflating dramatic vivid threats and deflating mundane familiar ones — so an unexamined-fear threat model is almost exactly wrong: over-defended against the rare, under-defended against the common.
The fourth question — what does protection cost and what does it buy — is the one that anxiety most wants to skip, and skipping it is the source of the over-protection failure that is as real and as harmful as under-protection. Every security measure has costs: money, time, convenience, freedom, and often a psychological cost in the form of a heightened sense of threat that the measure itself reinforces. A security measure is worth adopting only when its benefit — the reduction in expected harm from the threats it addresses — exceeds its total cost, and a measure whose costs exceed its benefits is a bad trade even if it genuinely reduces some risk. Threat modeling is not the pursuit of maximum safety at any cost; it is the pursuit of appropriate safety at a justified cost, and the discipline of weighing cost against benefit is what keeps it from collapsing into the anxious over-protection that sacrifices everything to marginal safety gains.
The costs of security measures are real and frequently underestimated because they are diffuse while the benefit is focal. The money cost is the most visible — security products and services cost money, and the security industry is highly motivated to sell you protection against threats whether or not they apply to you, which means a great deal of security spending addresses phantom threats and buys feelings rather than actual risk reduction. The time and convenience cost is larger than it looks because it recurs — a security measure that adds friction to your daily life imposes that friction every single day, and the accumulated cost of a burdensome measure over years can be enormous even if each instance is small. The freedom cost is the one the asset list flagged: measures that restrict where you go, what you do, and how you live consume the freedom-of-normal-life asset, and a security posture that leaves you physically safe but unable to live a normal life has traded away a real asset for another, which may or may not be a good trade depending on the actual threat. And the psychological cost is subtle but genuine: living in a heightened state of security-consciousness, treating the world as dangerous, and constantly attending to threats has a real cost to wellbeing, and a security posture calibrated to phantom threats imposes this cost for no corresponding benefit, making the anxious person less happy without making them safer.
The over-protection failure occurs when these costs are ignored and protection is pursued as though it were free, and it is the characteristic failure of the fearful, just as under-protection is the characteristic failure of the complacent. The over-protector adopts every security measure that addresses any possible threat, accumulates costs across all four dimensions, restructures their life around dangers that their honest threat model would have dismissed, and ends up worse off overall — poorer, more burdened, less free, and more anxious — without being meaningfully safer, because the threats they over-defended against were the phantoms that were never likely to harm them. This failure is genuinely as harmful as under-protection; it is simply harmful in a different currency, paying in money, freedom, and wellbeing rather than in exposure to real danger. And it is more insidious than under-protection because it feels responsible — the over-protector believes they are being prudent, when they are in fact making a bad trade, spending real assets to defend against unreal threats. The cost-benefit discipline is what exposes the over-protection as the bad trade it is, by insisting that the cost of each measure be weighed against the actual, honestly-assessed benefit, and that measures whose costs exceed their benefits be rejected however safe they feel.
The correct standard is proportionality — matching the level of protection to the honestly-assessed level of threat, so that serious threats warrant serious (and costly) protection while minor threats warrant only minor (and cheap) protection, and phantom threats warrant none. Proportionality is the antidote to both failures at once: it prevents under-protection by insisting that serious threats get serious defenses, and it prevents over-protection by insisting that the defense not exceed what the threat warrants. The proportionate response to an ordinary life with only opportunistic and impersonal threats is a modest set of cheap, low-friction measures — basic locks, basic awareness, basic emergency preparation — that address the real threats at low cost across all four cost dimensions, and no more. The proportionate response to a genuine targeted threat is a serious, costly set of measures that the ordinary person would be foolish to adopt. And the proportionate response to a phantom threat — a dramatic danger with no capable, motivated source behind it — is nothing, because defending against it spends real assets against an unreal threat. Getting proportionality right requires the honest capability-and-motivation assessment of the previous section, because you cannot match protection to threat until you have assessed the threat honestly, which is why the two sections are joined: honest threat assessment feeds proportionate response, and the pairing is what produces security that is neither anxious nor complacent but simply correct.
There is a specific and liberating consequence of the cost-benefit discipline that deserves explicit statement, because it inverts the anxious intuition. For most people with ordinary lives, the honest threat model prescribes less security effort than they feared, not more — because their real threats are opportunistic and impersonal, defensible with modest measures, and their dramatic imagined threats are phantoms warranting nothing. The threat model, honestly built, is thus frequently a source of relief rather than alarm: it reveals that the diffuse anxiety was mostly about phantoms, that the real threats are manageable with proportionate and inexpensive measures, and that the enormous vigilance the anxious person was contemplating is not warranted and would be a bad trade. This is the deepest reason that threat modeling is the antidote to anxiety rather than a fuel for it: done honestly, it usually shrinks the threat picture from the formless dread of "the world is dangerous" to the manageable specificity of "these few real threats, addressed by these few proportionate measures, and nothing more" — which is a smaller, cheaper, freer, and calmer place to stand than the anxious vigilance it replaces.
Key Insight: Every security measure costs money, time, convenience, freedom, and often wellbeing, and is worth adopting only when its honestly-assessed benefit exceeds those costs — protection is never free, and the over-protection failure (pursuing safety as though it were, restructuring life against phantom threats) is as harmful as under-protection, just paid in different currency and more insidious because it feels responsible. The correct standard is proportionality: serious threats warrant serious costly defenses, minor threats warrant minor cheap ones, phantom threats warrant nothing. For most ordinary lives an honest threat model prescribes less effort than feared, which is why it relieves anxiety rather than feeding it.
The module closes by assembling the four questions into a practice you can actually run to build your own threat model, because the concepts are only valuable when applied to your specific situation, and the specific application is the deliverable. Building a personal threat model is not a one-time exercise producing a document to file away; it is a periodically-revisited assessment that evolves as your life and circumstances change, because your threats change when your situation changes — a new relationship, a move, a new job, a public role, a conflict with someone can all alter the threat picture and warrant revisiting the model. This section lays out the practice, and the whole course from here builds on the model you construct.
Begin with the assets, working through the four from the earlier section and making them specific to you: what exactly are you protecting, ranked in order of importance. Name your physical safety and whose safety you are responsible for; name your property and recognize it ranks below safety; name your freedom of normal life and the ways a threat could constrain it; name the personal information whose exposure could enable threats to the others. Make the list concrete rather than abstract — not "my safety" but the specific situations and settings in which your safety is at stake, because the specific settings are where the threats will apply and where the defenses will act. The asset list is the foundation, and a specific, complete, ranked list is worth the effort to build carefully, because everything downstream is asked of these named assets.
Then, for each asset, work through the threat sources: what impersonal threats apply (the accidents and hazards realistic for your life and environment), what opportunistic threats apply (the ordinary crimes that target situations like yours), and — the critical question — whether any targeted threats apply, meaning whether anyone actually has a specific reason and the capability to target you in particular. This last question deserves honest, careful attention in both directions: do not invent targeted threats where none exist (the anxious error that manufactures phantom enemies), and do not deny targeted threats that genuinely exist (the denial error that minimizes a real motivated adversary because acknowledging them is frightening). For most people the honest answer is that no targeted threat applies and the threat picture is entirely impersonal and opportunistic — which is the relieving result that prescribes only modest, proportionate measures. For some people a targeted threat genuinely applies, and for them the honest recognition of it is the most important output of the whole exercise, because it moves them into the serious-defense regime that the later modules develop and that their situation actually warrants.
Then assess each identified threat for capability and motivation, honestly and factually, resisting the two-sided fear distortion — not inflating the dramatic threats nor deflating the mundane ones, but assessing each against what is actually known about how such threats manifest for people in situations like yours. This assessment produces the triage: the threats that are high on both capability and motivation rise to the top as the ones warranting real defensive investment, the threats high on only one factor are recognized as the lower priorities or phantoms they are, and the impersonal threats take their proper large place as the statistically-dominant category for the ordinary person. The triage is the heart of the model — it converts the list of possible threats into a prioritized list of real threats, which is what the finite protective resources should be allocated against.
Finally, for each prioritized threat, consider the proportionate response — the measures whose benefit in reducing that threat exceeds their cost across money, time, convenience, freedom, and wellbeing — and adopt those, and only those. This is where the model becomes action: not a list of fears but a list of proportionate, justified measures matched to real, prioritized threats, which is exactly the security the module set out to produce. The output of the whole practice is a clear picture of your actual threats, prioritized by their real danger, paired with proportionate measures that address them at justified cost — and, for most people, that picture is smaller, more specific, more manageable, and calmer than the diffuse anxiety it replaces. You will carry this model forward through the rest of the course: the environmental assessment of the next module reads the settings where your threats apply, the pre-attack indicators teach you to recognize a targeted threat manifesting, the routine and travel security modules develop the proportionate measures, and the final module assembles it all into a personal security plan built on the threat model you construct here. The model is the foundation; everything else is built on the specific, honest answer you give to the question this module has taught you to ask — what specifically threatens me, and what, proportionately, should I do about it.
Key Insight: Build your threat model by running the four questions on your specific situation: name and rank your concrete assets; for each, identify the impersonal, opportunistic, and — honestly, in both directions — the targeted threats that actually apply; assess each for capability and motivation against what is factually known, resisting fear's two-sided distortion, to produce a prioritized triage of real threats; then match proportionate, cost-justified measures to the prioritized threats and adopt only those. The model is a periodically-revisited assessment, not a one-time document, and for most people it yields a smaller, calmer, more manageable picture than the anxiety it replaces — the foundation the rest of the course builds on.
This module built the foundation of personal security: the threat model, a structured, person-specific, decision-oriented answer to what you are protecting, who or what threatens it, how capable and motivated those threats are, and what proportionate protection costs and buys. The master distinction among impersonal, opportunistic, and targeted threats determines which family of defenses applies; the capability-times-motivation assessment separates real threats from anxiety's phantoms; and the cost-benefit proportionality discipline guards equally against under-protection and the over-protection that sacrifices real assets against unreal threats. Done honestly, the threat model is the antidote to both denial and anxiety, replacing formless dread with specific, manageable knowledge.
The threat model tells you what threatens you; the next module teaches you to read where — the environment in which threats manifest and the skill of assessing the safety of the places and situations you move through. Environmental threat assessment develops situational awareness not as the diffuse hyper-vigilance that exhausts without protecting, but as the specific, trainable skill of reading a setting for the indicators that matter — the layout, the exits, the people, the anomalies — and calibrating your attention to the actual risk of the actual place. Where this module built the model of your threats in the abstract, Environmental Threat Assessment teaches you to see those threats in the concrete settings where they would actually occur, which is the necessary next step from knowing your threats to actually avoiding them.