Most people's security setup is a pile of habits nobody chose: a password from university days, a phone that joins any open Wi-Fi, and a vague sense that backups would be a good idea someday. A threat model replaces that fog with three questions — what do I have, who wants it, and what actually stops them. You can answer those well enough in half an hour. Not perfectly. Well enough to stop guessing.
Assets: What Are You Actually Protecting?
Start with a list, not a shopping trip for tools. Assets are things that would cost you money, time, or sleep if they disappeared or ended up in the wrong hands. For most people, the real list is shorter than they expect.
- Accounts that move money or speak as you: primary email, bank, payment apps, work logins.
- Devices: laptop, phone, the external drive holding your tax records.
- Irreplaceable data: family photos, unfinished drafts, client files, your password vault.
- Privacy and reputation: home address, relationship details, daily location patterns.
- Access itself: the email address that can reset every other account you own.
- Physical items: passport, spare keys, the code to the safe.
Now rank them. A short list of three "if this goes, I have a bad month" items beats twenty items you'll never get to. If you can only rank one thing, rank your primary email — it is the reset key for nearly everything else. Give it a long unique password and two-factor authentication before you touch anything else on the list.
Adversaries: Who Would Realistically Come for It?
Adversaries aren't villains from a film. They're categories of people and systems with motive and opportunity. Being honest about who is realistic keeps you from building a bunker against a threat you will never face.
Tier 1: Opportunists
Credential-stuffing bots replaying leaked passwords, a laptop lifted in a café, a phone snatched at a bar, a text pretending to be a missed delivery. They aren't targeting you. They harvest whatever is easy.
Tier 2: Motivated individuals
An ex-partner who still knows your answers to security questions. A roommate. A former coworker. A harassing stranger who has read your public posts and knows where you work. These attackers use familiarity, not exploits.
Tier 3: Professionals
Organized fraud, phishing campaigns aimed at a business or a person with money, state-level interest. Rare for most individuals. If you're a journalist, an activist, or you hold other people's money, treat this tier as real and get help from people who do this work.
Write down which tiers apply. Most readers land on Tier 1 plus a slice of Tier 2 — and that is the correct answer, not a failure of imagination.
Attack Paths: How Would They Actually Get In?
For each asset, ask how someone reaches it. The paths repeat across nearly every household:
- Your email → password reset → every other account
- Your phone number → intercepted SMS code → bank and email
- Your unlocked phone → saved passwords, photos, payment apps
- Your router's default admin password → every device on the network
- Your public posts → answered security questions → account recovery abuse
- An unencrypted backup drive → one theft, complete data loss
Pick the two or three paths that end at the assets you ranked highest. Those get your attention this month. The rest can wait.
Defenses: Matching Effort to Risk
Security advice usually fails because it's all-or-nothing. Match the defense to the asset and the adversary instead.
- Use a password manager. One long passphrase protects the vault; every other login gets its own random password. Reuse is what turns one breach into six.
- Turn on two-factor authentication, preferring app-based codes or a hardware key over SMS where the service offers it.
- Lock down the email account first. Unique password, 2FA, recovery options you control, and a check for forwarding rules you didn't create.
- Encrypt your devices. Full-disk encryption on laptop and phone, with a real passcode rather than a pattern someone can watch you tap.
- Back up in two places, keeping one copy offline and one somewhere else entirely. Test a restore once so you know it works.
- Patch everything automatically — phone, laptop, browser — and change the router's default admin password while you're at it.
- Shrink your public footprint. Remove your home address and phone number from profiles that don't need them; use a work address for deliveries.
- Consider freezing your credit if identity theft is a realistic worry. The rules differ by country, so ask your bank or a qualified financial professional if you're unsure how it works where you live.
Write It Down, Then Review It
Keep it to one page: your assets, your adversary tiers, the top attack paths, and the defenses you'll actually do this month. Include the risks you are deliberately accepting — "my old gaming account may get compromised; I don't use it for anything important" is a legitimate entry. Naming a risk out loud removes both the guilt and the background hum of worry.
Revisit the page every few months, or when something changes: a new job, a move, a breakup, a business, a breach notice arriving in your inbox. It takes twenty minutes. If a situation feels legally or financially significant — a stalker, a serious data breach, a liability question at work — speak to a lawyer or a qualified advisor rather than improvising.
Your First Thirty Minutes
Set a timer. Ten minutes to list assets and rank the top three. Ten to name the adversary tiers that actually apply. Ten to start two defenses — two, not eight.
For almost everyone, the two best defaults are a password manager with unique passwords and app-based 2FA on the primary email address. Do those tonight. Add device encryption and a tested backup next weekend, and you're ahead of the many people who have read a dozen security articles and changed nothing.
The point was never to become unhackable. It's to know which fights you're actually in, spend your effort there, and stop carrying around the vague feeling that you've forgotten something.
Photo: Sora Shimazaki / Pexels
