Security advice is usually delivered as a universal list: use a password manager, enable two-factor, encrypt your devices, use a VPN, minimise your data footprint. All reasonable, and applied uniformly it means someone spends effort on measures irrelevant to them while missing the one that mattered.
Threat modelling is the step before the list. Who might come after you, what do they want, and what would it cost you if they got it?
What changed in 2026
- Targeted impersonation became cheaper. Voice and video cloning made person-specific attacks accessible to ordinary criminals — see deepfake scam protection.
- Breach frequency stayed high. Opportunistic credential attacks remained the dominant threat for most people.
- Interpersonal threats got more recognition. Security guidance began addressing former partners and family members as a distinct category.
- Advice remained largely undifferentiated. Most public guidance still assumed one threat model.
Four questions
What do I have that someone would want? Money and payment credentials. Account access, especially email. Personal data usable for impersonation. Private communications. Physical property. Professional access to systems.
Who might want it? Opportunistic criminals with no interest in you specifically. Someone who knows you personally. A company or data broker collecting for commercial purposes. In some situations, an employer, a government, or a party in a dispute.
How bad would it be? Recoverable inconvenience, financial loss, professional damage, or personal safety. These are very different, and the effort worth spending scales with the answer.
How much effort will I actually sustain? A precaution you abandon in three weeks protects nothing.
Most people face opportunistic attackers
The single most useful realisation for most readers.
Opportunistic attackers do not target you. They obtain credentials from a breach, try them across many services, and see what works. They send phishing to millions and act on whoever responds. They are working at scale, and anyone who is meaningfully harder than average is simply skipped.
Against that threat, basic measures are disproportionately effective. Unique passwords defeat credential reuse entirely. Phishing-resistant authentication defeats the standard attack outright — see security keys explained. A credit freeze blocks new account fraud.
None of that requires elaborate operational security, and it addresses the overwhelming majority of what actually happens to people.
| Threat |
Who faces it |
Effective response |
| Credential stuffing |
Everyone |
Unique passwords |
| Phishing |
Everyone |
Security keys, callback verification |
| SIM swap |
Anyone with valuable accounts |
Carrier lock, avoid SMS |
| Someone who knows you |
Specific situations |
Different approach entirely |
| Commercial data collection |
Everyone |
Data broker removal, aliases |
When the threat is personal
A materially different problem, and generic advice serves it badly.
Someone who knows you may already have your passwords, know your security question answers, have physical access to your devices, be a recovery contact on your accounts, or appear on your family phone plan.
The standard measures assume an outsider. Against someone with prior access, the priorities shift: reviewing which devices are signed in and removing unknown ones, changing recovery contacts and security questions, checking for account-level sharing and family plan access, checking for location sharing enabled long ago, and reviewing whether shared accounts still make sense.
This is a genuine category that public guidance underserves, and someone in that situation should look for resources specific to it rather than following a general list.
Common mistakes
- Applying advice without asking whether it addresses your threat. Effort in the wrong place.
- Elaborate measures you will abandon. Complexity that lapses protects nothing.
- Assuming you are not a target. Opportunistic attacks target nobody in particular, which includes you.
- Overlooking email. The recovery path for everything else — see account recovery planning.
- Treating a personal threat with generic advice. Different problem, different response.
- Never revisiting the model. Circumstances change.
- Confusing privacy with security. Related, and different goals with different measures.
FAQ
Where should most people start?
Unique passwords in a manager, phishing-resistant authentication on email first, and a credit freeze. Those three address the majority of what actually happens to ordinary people.
Do I need a VPN?
For the threat most people face, rarely — the classic public Wi-Fi risk was largely resolved by universal encryption. Buy one for what it actually does rather than for that — see public Wi-Fi safety.
How often should I reassess?
After any significant life change — a relationship ending, a new job with sensitive access, a public role. Otherwise annually is ample.
What if I do face a serious targeted threat?
Generic guidance is insufficient. Seek resources specific to your situation, and consider professional help. The measures differ meaningfully from ordinary advice.
Where to go next
For the highest-value general measures, read security keys explained and account recovery planning. For responding after something goes wrong, breach response checklist.