Security culture is built on worst-case thinking, which is rational when you are securing a government agency or a bank. It is paralyzing when you apply it to ordinary life. Someone has to think about what actually threatens you.
For most people, the real threats are not sophisticated attacks. They are convenience and carelessness — yours and others’. A realistic threat model for ordinary people focuses on the few things that realistically matter.
The actual threats
Account takeover through credential reuse. Your email address and password get into a database somewhere — through a breach you didn’t cause or even know about. An attacker tries that credential on your email, your bank, your cloud storage.
This is the threat that actually happens constantly. Credential stuffing is how the vast majority of account compromises work. It is neither sophisticated nor expensive. The attacker buys a list of emails and passwords for a few pounds and tries them everywhere.
Phishing and social engineering. Someone sends you something that looks legitimate and you click a link, open an attachment, or tell them information you should not. You end up with malware on your device, or an attacker gains access to an account.
This is still the most common initial compromise vector in security incidents. It works because it exploits the weakest point in any security system: humans responding to something that looks plausible.
Device theft or loss. Your phone goes missing, or someone steals your laptop. If the device is not encrypted and password-protected, everything on it is available to whoever took it.
Weak or reused passwords. You use the same password for email, banking, and social media. One site is breached and the attacker tries that password elsewhere.
Software installed from untrusted sources. You download an application that claims to be legitimate but is malware. This is less common now than it was five years ago because of app stores and code signing, but it still happens, especially on Windows.
Unpatched software. A vulnerability is found in software you use, a patch is released, and you do not install it for six months. An attacker exploits the known vulnerability. Your software is out of date by choice, not by accident.
These six things account for the vast majority of security incidents affecting ordinary people. Notice that zero of them involve a sophisticated hacker breaking encryption or exploiting an obscure zero-day.
Who actually threatens you
For most people, the realistic attackers are:
Automated systems. Bots scanning the internet for vulnerable sites, sending phishing emails at scale, trying stolen credentials everywhere. These are not targeted at you specifically. You are attacked because you are one of millions of addresses in a list.
Criminals operating at scale. Ransomware groups, phishing operations, fraud rings. They are not interested in you personally. You are valuable if you are easy and numerous. They move on if you are not.
People who know you. An ex-partner or family member trying to access your email or social media. A colleague trying to find out about a competitor. Someone trying to take over your accounts for social reasons rather than financial ones.
Your actual personal risk from sophisticated or state-sponsored attackers is close to zero unless you are a journalist, an activist, or a government employee. If you are none of those things, your threat model is much simpler.
The defences that actually matter
Long unique passwords, managed by a password manager. This stops the credential reuse attack entirely. You never reuse credentials and they are too long to guess. A password manager like Bitwarden or 1Password costs a few pounds a month and eliminates a huge class of attacks.
Two-factor authentication on email. Your email account is the master key to everything else. Two-factor authentication (using an authenticator app rather than SMS, which can be intercepted) makes it extraordinarily difficult to take over.
Automated updates. Enable automatic updates on every device. Automatic updates introduce small risks, but known unpatched vulnerabilities introduce larger ones. The trade-off is decidedly in favour of updates.
Common sense about links and attachments. Do not click links in unexpected emails or texts. If an email says it is from your bank, go to the bank’s website directly instead of clicking the link. If something looks weird, verify through another channel. This is not glamorous, but it stops most phishing.
Encryption on your devices. Enable FileVault on macOS, BitLocker on Windows, or the built-in encryption on your phone. This means if your device is stolen, the contents are inaccessible without your password.
These six things, implemented properly, reduce your realistic attack surface by more than 95%. Everything else is refinement.
What provides diminishing returns
VPN everywhere. A VPN is useful if you use untrusted WiFi networks regularly and you are concerned about a malicious network operator intercepting your traffic. For home internet, it provides almost no benefit. Most services use HTTPS anyway, which encrypts traffic independent of the VPN.
Obscure browsers and operating systems. Using a less common operating system makes you a less interesting target for automated attacks, which is true. It also means you get security updates slower and have fewer eyes on your security. The trade-off is unclear, and you probably care more about something else.
Perfect password hygiene. A password changed monthly, never written down anywhere, unique to every site. If you have a password manager, this happens automatically. If you do not, perfect hygiene is not worth the stress. “Pretty good” hygiene with a password manager beats “perfect” hygiene memorising passwords.
Threat intelligence about zero-days. Knowing about vulnerabilities before patches exist is useful if you are a security professional. For ordinary people, you cannot do anything with the information except worry.
Building your personal threat model
Ask these questions:
What am I protecting? Money, privacy, reputation, convenience, or some combination?
From whom? Automated attackers, criminals, people who know me, someone else?
What is the cost of compromise? A little embarrassment, financial loss, serious damage to reputation?
What is my tolerance for inconvenience? Am I willing to take friction in exchange for security?
Based on those answers, choose defences that make sense.
Someone protecting money from criminals they do not know should have strong unique passwords and two-factor authentication. Someone protecting privacy from state surveillance has much harder problems.
Someone tolerating moderate friction might use a password manager and two-factor authentication on important accounts. Someone wanting minimal friction might do just those on email and banking accounts, accepting more risk elsewhere.
The person trying to protect against sophisticated targeted attacks has genuinely hard problems that this article does not address. Everyone else should focus on the six things listed above and stop worrying about exotic threats.
A concrete example
Alice is a freelancer with a bank account, email, cloud storage, and social media. Her realistic threat is not sophisticated: someone tries stolen credentials, sends her a phishing email, or steals her laptop.
Her protection:
- Bitwarden password manager with unique strong passwords for everything
- Authenticator app for two-factor on email and banking
- FileVault enabled on her laptop
- Automatic updates on everything
- A rule: suspicious emails get verified by visiting the site directly, not clicking the link
Cost: 18 pounds per year for the password manager. Time investment: two hours to set up, five minutes a year to maintain.
That is a realistic threat model and a realistic response to it.