{"post":{"slug":"threat-modeling-for-people-2026","title":"Personal Threat Modelling: Who Are You Protecting Against?","excerpt":"Generic security advice assumes everyone faces the same risks. Deciding who might target you, and what they want, tells you which precautions are worth the effort.","category":"guides","date":"January 29, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">S</span>ecurity advice is usually delivered as a universal list: use a password manager, enable two-factor, encrypt your devices, use a VPN, minimise your data footprint. All reasonable, and applied uniformly it means someone spends effort on measures irrelevant to them while missing the one that mattered.\n\nThreat modelling is the step before the list. Who might come after you, what do they want, and what would it cost you if they got it?\n\n## What changed in 2026\n\n- **Targeted impersonation became cheaper.** Voice and video cloning made person-specific attacks accessible to ordinary criminals — see [deepfake scam protection](/blog/deepfake-scam-protection-2026).\n- **Breach frequency stayed high.** Opportunistic credential attacks remained the dominant threat for most people.\n- **Interpersonal threats got more recognition.** Security guidance began addressing former partners and family members as a distinct category.\n- **Advice remained largely undifferentiated.** Most public guidance still assumed one threat model.\n\n## Four questions\n\n**What do I have that someone would want?** Money and payment credentials. Account access, especially email. Personal data usable for impersonation. Private communications. Physical property. Professional access to systems.\n\n**Who might want it?** Opportunistic criminals with no interest in you specifically. Someone who knows you personally. A company or data broker collecting for commercial purposes. In some situations, an employer, a government, or a party in a dispute.\n\n**How bad would it be?** Recoverable inconvenience, financial loss, professional damage, or personal safety. These are very different, and the effort worth spending scales with the answer.\n\n**How much effort will I actually sustain?** A precaution you abandon in three weeks protects nothing.\n\n## Most people face opportunistic attackers\n\nThe single most useful realisation for most readers.\n\nOpportunistic attackers do not target you. They obtain credentials from a breach, try them across many services, and see what works. They send phishing to millions and act on whoever responds. They are working at scale, and anyone who is meaningfully harder than average is simply skipped.\n\nAgainst that threat, basic measures are disproportionately effective. Unique passwords defeat credential reuse entirely. Phishing-resistant authentication defeats the standard attack outright — see [security keys explained](/blog/security-keys-explained-2026). A credit freeze blocks new account fraud.\n\nNone of that requires elaborate operational security, and it addresses the overwhelming majority of what actually happens to people.\n\n| Threat | Who faces it | Effective response |\n| --- | --- | --- |\n| Credential stuffing | Everyone | Unique passwords |\n| Phishing | Everyone | Security keys, callback verification |\n| SIM swap | Anyone with valuable accounts | Carrier lock, avoid SMS |\n| Someone who knows you | Specific situations | Different approach entirely |\n| Commercial data collection | Everyone | Data broker removal, aliases |\n\n## When the threat is personal\n\nA materially different problem, and generic advice serves it badly.\n\nSomeone who knows you may already have your passwords, know your security question answers, have physical access to your devices, be a recovery contact on your accounts, or appear on your family phone plan.\n\nThe standard measures assume an outsider. Against someone with prior access, the priorities shift: reviewing which devices are signed in and removing unknown ones, changing recovery contacts and security questions, checking for account-level sharing and family plan access, checking for location sharing enabled long ago, and reviewing whether shared accounts still make sense.\n\nThis is a genuine category that public guidance underserves, and someone in that situation should look for resources specific to it rather than following a general list.\n\n## Common mistakes\n\n- **Applying advice without asking whether it addresses your threat.** Effort in the wrong place.\n- **Elaborate measures you will abandon.** Complexity that lapses protects nothing.\n- **Assuming you are not a target.** Opportunistic attacks target nobody in particular, which includes you.\n- **Overlooking email.** The recovery path for everything else — see [account recovery planning](/blog/account-recovery-planning-2026).\n- **Treating a personal threat with generic advice.** Different problem, different response.\n- **Never revisiting the model.** Circumstances change.\n- **Confusing privacy with security.** Related, and different goals with different measures.\n\n## FAQ\n\n**Where should most people start?**\nUnique passwords in a manager, phishing-resistant authentication on email first, and a credit freeze. Those three address the majority of what actually happens to ordinary people.\n\n**Do I need a VPN?**\nFor the threat most people face, rarely — the classic public Wi-Fi risk was largely resolved by universal encryption. Buy one for what it actually does rather than for that — see [public Wi-Fi safety](/blog/public-wifi-safety-2026).\n\n**How often should I reassess?**\nAfter any significant life change — a relationship ending, a new job with sensitive access, a public role. Otherwise annually is ample.\n\n**What if I do face a serious targeted threat?**\nGeneric guidance is insufficient. Seek resources specific to your situation, and consider professional help. The measures differ meaningfully from ordinary advice.\n\n## Where to go next\n\nFor the highest-value general measures, read [security keys explained](/blog/security-keys-explained-2026) and [account recovery planning](/blog/account-recovery-planning-2026). For responding after something goes wrong, [breach response checklist](/blog/breach-response-checklist-2026).","hue":150,"metaTitle":"Personal Threat Modelling: Who Are You Protecting From?","metaDescription":"How to decide which security precautions are worth your effort by identifying who might target you and what they want.","keywords":["personal threat modeling","security risk assessment","opportunistic vs targeted","privacy planning","personal security","digital safety","risk prioritisation","security basics 2026"],"tldr":["**Name the adversary before choosing defences** — a random criminal and a known individual need different precautions.","**Most people face opportunistic attackers, not targeted ones** — which makes basic hygiene disproportionately effective.","**Some situations genuinely warrant more** — an ex-partner with your passwords is a different problem.","**Effort spent on the wrong threat is wasted** — and can crowd out the precaution that mattered.","**Skip:** elaborate measures against threats you do not face. Complexity you abandon protects nothing."],"readTime":"4 min read","wordCount":826},"related":[{"slug":"account-recovery-planning-2026","title":"Account Recovery Planning: The Weakest Link You Chose","excerpt":"You secured your accounts carefully. Then you set a recovery method, and that method is now the easiest way in — for an attacker, and the hardest for you.","category":"guides","date":"August 13, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":168},{"slug":"layoff-preparation-guide-2026","title":"Preparing for a Layoff Before It Happens","excerpt":"The work that makes a layoff survivable is done while you still have a job. Here is what to put in place and what the warning signs look like.","category":"guides","date":"August 6, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":44},{"slug":"public-wifi-safety-2026","title":"Public Wi-Fi Safety: What the Advice Got Wrong","excerpt":"The warnings about coffee shop Wi-Fi were written for an internet without universal encryption. The real risks now are different, and so are the fixes.","category":"guides","date":"August 13, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":152}],"sameCategory":[{"slug":"energy-bill-optimization-2026","title":"Energy Bill Optimization: Tariff First, Hardware Later","excerpt":"Most advice starts with buying something. The largest savings usually come from your tariff and when you run things. Here is the order that actually works.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":152},{"slug":"lease-break-guide-2026","title":"Breaking a Lease Without Wrecking Your Finances","excerpt":"Leaving before the term ends has costs, and they are frequently smaller than tenants fear. Here are the routes out and the duty landlords have.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":276},{"slug":"security-deposit-guide-2026","title":"Getting Your Security Deposit Back","excerpt":"Deposit disputes are won at move-in, not at move-out. Here is the documentation that decides them and what landlords can legally deduct.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":270},{"slug":"small-claims-court-guide-2026","title":"Small Claims Court: Suing Without a Lawyer","excerpt":"Small claims is designed for people to represent themselves over modest amounts. Here is how to prepare a case and the part nobody plans for.","category":"guides","date":"August 19, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":280}],"newer":{"slug":"san-francisco-ai-economic-paradox-2026","title":"San Francisco's AI boom and the economic paradox of 2026","excerpt":"San Francisco is the AI capital of the world in 2026 — and an economic laggard at the same time. Here is the plain-English explanation of why both can be true, and what it means for tech workers and the city.","category":"ai","date":"January 29, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":200},"older":{"slug":"vibe-coding-guide-2026","title":"Vibe coding in 2026: what it actually is and whether it works","excerpt":"The term \"vibe coding\" went from Twitter joke to serious engineering methodology in six months. Here is the honest breakdown of what it actually means, where it pays off, and where it quietly fails.","category":"ai","date":"January 29, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":205}}