Privacy advice becomes overwhelming when every possible attacker and every available tool are treated as equally important. A personal threat model solves that problem by connecting specific information to specific observers and consequences. It helps you spend attention where it changes risk instead of collecting privacy products that do not work together.

You can create a useful first version in one hour. The result is not a prediction and does not need technical language. It is a decision record: what you care about, who might seek it, how they could obtain it, what the impact would be, and which controls are practical. Revisit it when your job, relationships, location, or public visibility changes.

Minutes 0–10: list assets as real things

An asset is information, access, or a capability whose exposure or loss matters. Avoid writing only broad labels such as “privacy” or “my data.” Name the item and why it matters. Examples include a home address, private photographs, a source’s identity, control of a domain, access to financial accounts, a travel plan, medical correspondence, draft research, or the ability to publish under a pen name.

Add availability and integrity, not only confidentiality. You may need a website to stay online, an emergency contact list to remain accessible, or a document to remain unaltered. A ransomware incident that encrypts family records is different from a leak, but both belong in the model. Write five to ten assets. A shorter list forces prioritization.

Beside each asset, note where it currently exists: phone, laptop, cloud account, email archive, paper file, shared drive, messaging history, registrar, or another person’s device. This inventory will reveal copies you forgot. Privacy controls often fail because an old copy remains in a less protected location.

Minutes 10–20: identify plausible observers and events

An observer is a person or organization that could gain access. It might be a data broker, scammer, abusive acquaintance, employer, service provider, device thief, curious coworker, commercial tracker, or government authority acting through lawful process. You can also include accidental events such as a lost phone, misaddressed email, public document link, or failed backup.

Be specific enough to estimate capability. “Hackers” is too broad. A credential-stuffing attacker using passwords from another breach has different access than a person who knows your security answers. A local thief can hold the device but may not know your cloud password. A platform provider can process stored content but may not have a way to unlock a separately encrypted archive.

Do not inflate every observer into the most capable adversary imaginable. Defending against a nation-state, a roommate, and an advertising network with the same plan produces expensive, fragile systems. Record the observers that are reasonably connected to your life or the consequence of the asset.

Minutes 20–30: draw the likely access paths

For each high-value asset, write two or three ways it could be reached. A home address might appear in public property records, domain registration, shipping accounts, people-search sites, photographs, or a friend’s contact upload. A private message might be exposed through the sender’s device, the recipient’s device, notification previews, cloud backups, screenshots, or account recovery.

Access paths should include people and processes. Support staff, shared administrators, family accounts, and emergency access can be legitimate pathways that become risky under the wrong conditions. Marketing integrations, browser extensions, bots, and calendar tools often gain broad permission quietly. Listing them turns invisible trust into visible architecture.

Mark dependencies. If email can reset the password manager, and the password manager holds the email password, the recovery loop may fail. If a domain controls email and email recovers the registrar, one compromised account can cascade. Dependencies usually deserve more attention than isolated features.

Minutes 30–40: score consequence and likelihood

Use a simple three-level scale. Consequence can be low, meaningful, or severe. Likelihood can be uncommon, plausible, or frequent. You do not need precise numbers. The purpose is to separate risks that demand immediate action from risks that can be accepted or monitored.

Describe consequence in human terms. Exposure might cause embarrassment, financial loss, physical safety concerns, professional retaliation, loss of access, legal complexity, or harm to another person. Include the burden of recovery. A small account with a difficult identity-verification process may create more disruption than its monetary value suggests.

Challenge your first ratings. Are you reacting to a dramatic story rather than your actual exposure? Are you underestimating a routine risk because it feels boring? Reused passwords, outdated devices, public document links, and unreviewed account recovery are common pathways. Sophisticated malware is real, but ordinary account hygiene often deserves the first hour.

Minutes 40–50: choose controls that reduce a path

A control should interrupt a specific access path. A password manager and unique passwords reduce credential reuse. Strong multi-factor authentication reduces the value of a stolen password. A private domain registration service can reduce public contact exposure. End-to-end encrypted messaging can limit provider access to content. A locked, encrypted device reduces exposure after physical loss. Independent backups reduce the consequence of deletion or ransomware.

Prefer controls with multiple benefits and low maintenance. Updating devices, removing unused accounts, limiting app permissions, and securing the primary email account can reduce several risks at once. Avoid adding tools that create confusing recovery paths or duplicate functions. Complexity is itself a vulnerability when it causes missed updates, lost keys, or unsafe workarounds.

For every new control, write the failure mode. What happens if a hardware key is lost? Who can recover an encrypted archive? Does an alias provider become another critical account? Can a family member access essential records in an emergency? A control is not complete until recovery is understood.

Minutes 50–60: make a three-step action plan

Choose one action to complete today, one this week, and one this month. Today might be securing the primary email account and saving recovery codes. This week might be reviewing public data-broker profiles or moving sensitive conversations to a vetted messenger. This month might be separating domains, testing backups, or creating a physical document vault.

Assign an owner and a completion test. “Improve account security” is not testable. “Register two security keys, store the spare in the document safe, and confirm recovery codes work” is. For shared risks, involve the other person rather than imposing a system they cannot use. Privacy is cooperative whenever information crosses devices or relationships.

Schedule the next review. A quarterly ten-minute check is enough for many people. Review sooner after a move, job change, relationship change, public controversy, device loss, or major new account. Retire controls that no longer reduce a meaningful path.

Build a one-page threat-model worksheet

  • Asset: What specific information, access, or capability matters?
  • Location: Where do copies exist, including other people’s devices and backups?
  • Observer or event: Who or what could reach it?
  • Path: Which account, device, person, record, or process provides access?
  • Consequence: What harm or recovery burden would follow?
  • Likelihood: Is the path uncommon, plausible, or frequent in your situation?
  • Control: Which practical change interrupts the path or reduces the consequence?
  • Recovery: How will you regain access or warn affected people when the control fails?
  • Review date: When will you check that the assumptions are still true?

Use one row per important risk. The worksheet pairs naturally with the PrivateDropBox.com privacy stack, which organizes controls across identity, communications, network, hosting, devices, and physical storage. It also helps you decide whether a VPN addresses your actual observer or merely feels like a general privacy purchase.

Avoid four common modeling mistakes

First, do not model only attackers. Service outages, forgotten passwords, accidental sharing, and family emergencies can produce serious privacy failures. Second, do not assume a product eliminates a risk; identify the pathway it changes and the pathways that remain. Third, do not ignore other people. A correspondent, administrator, or household member may hold the same information under different controls. Fourth, do not keep adding defenses without removing old copies and unused accounts.

The model should also state what you are not defending against. Accepting a low-consequence risk is a legitimate decision. Documenting that choice prevents guilt-driven tool switching and preserves energy for the controls that matter.

Use a framework that starts with your circumstances

The EFF Surveillance Self-Defense security plan guides readers through assets, adversaries, consequences, likelihood, and willingness to act. Its central insight is that security planning is personal: the right tool depends on what you need to protect and from whom.

After sixty minutes, you should have a small asset inventory, a map of plausible access paths, and three concrete actions. That is more useful than a long list of products. A threat model gives privacy work an order, a stopping point, and a reason. It lets you build protection that fits your life instead of borrowing someone else’s fear.