Start here: threat modeling

What threat modeling is

You already do this for physical safety: you lock your front door, but you probably do not hire a guard. Security engineers use structured methods, such as the four questions of the Threat Modeling Manifesto, to analyse software. For personal privacy, a short set of plain questions, popularised by the EFF's Surveillance Self-Defense project, does the job. Four words come up again and again:

Asset: something you value and want to protect. Usually information, sometimes a device, your money or your physical safety.
Adversary: a person or organisation that might go after an asset. It can be a company, a criminal, a government or someone you know.
Threat: something an adversary could do, such as phishing your email password or seizing your phone.
Risk: how likely a threat is to happen to you, combined with how bad it would be if it did.

There is always a trade-off between security, privacy and convenience. No setup is safe from everyone, and trying to defend against everything at once usually means defending against nothing well.

Six questions to ask

What do I want to protect? Messages, files, contacts, location, accounts, money, your identity, and the people who rely on you.
Who do I want to protect it from? Be specific. "A former partner who knows my passwords" is far more useful than "hackers".
How likely is it that I will need to protect it? Think about what each adversary can actually do and how motivated they are. Your mobile carrier certainly records who you call. A government building a zero-click exploit for your phone is unlikely for most people.
How bad are the consequences if I fail? Embarrassment, lost money, a lost job, prison or physical harm. Rank them.
How much trouble am I willing to go through? Time, money and convenience are real costs. A plan you abandon after two weeks protects nothing.
Who can help me? Colleagues, friends, an organisation or an advocate. Security is often a group effort: a conversation is only as private as the least careful person in it.

Deal first with what is both likely and damaging. For almost everyone that means account takeover and leaked data. Then deal with rare but severe risks if your answers to questions 2 and 4 call for it. Anything you choose not to defend against is a risk you accept, which is fine as long as it is a decision rather than an oversight.

A worked example

Asset	Adversary	Likelihood	Impact	Sensible first step
Main email account	Criminals using leaked passwords or phishing	High	High: it can reset most of your other accounts	Unique password plus a passkey or security key (Passwords)
Browsing and app activity	Advertisers and data brokers	Near certain	Low per item, larger in aggregate	Tracker-blocking browser, fewer app permissions (Browsers)
Phone contents	A thief, or police at a border or protest	Low to moderate	High	Long passcode, encryption, less data stored (Encryption)
Home address	A stalker or online harasser	Low for most, high for some	Severe	Remove listings from people-search sites (OSINT defense)
Who you talk to	Carriers and platforms, and anyone who can demand their records	Recorded by default	Depends on who you talk to	Encrypted apps that keep little metadata (Messaging, Metadata)

One person's answers. Yours will differ.

Who you might be up against

Adversary	What they can typically do	What helps most
Advertisers, data brokers and platforms	Track browsing, app use, purchases and location across services; build and sell profiles	Tracker blocking, fewer accounts, email aliases, opt-outs (Browsers, Email)
Opportunistic criminals	Phishing, trying leaked passwords, password-stealing malware, SIM swaps, scams	Updates, a password manager, phishing-resistant 2FA, a carrier PIN (Passwords)
Someone close to you	Handle your devices, know your passwords and security answers, share accounts or family plans, install stalkerware, hide trackers	Careful changes from a safer device, after safety planning (see below)
Service providers and employers	Read whatever their service handles unencrypted, plus metadata; employers can monitor work devices and networks	End-to-end encryption, personal devices kept separate, self-hosting (Cloud storage)
Police and courts	Demand records from companies, seize devices, and in some countries compel unlocking or passwords	Keep less data, end-to-end encryption, a strong passcode, a lawyer who knows local law
Well-resourced state agencies	Intercept phone networks, send targeted phishing and zero-click spyware, use informants	Prompt updates, Lockdown Mode or Advanced Protection, separate identities, expert help (Operating systems)

Most people deal with the first two rows every day and never meet the last one. Defences against a stronger adversary usually cover weaker ones too, but cost more effort. You may face several at once: an activist has both data brokers and the police to think about.

Four example threat models

These are sketches, not templates. Read the one closest to you, then adjust it to your own answers.

Everyday privacy: less tracking, fewer leaks

Protecting: browsing and purchase habits, location history, contact details and accounts. From: ad networks, data brokers, platforms, and criminals working from leaked data. Likelihood: tracking is constant and account takeover attempts are common. Impact: usually moderate, unless a takeover leads to fraud. Willing to do: a few hours of setup and little ongoing hassle.

Do the baseline first. For most people the most damaging realistic event is an account takeover, not an ad profile.
Switch to a browser that blocks trackers by default and add a content blocker (Browsers); use a search engine that does not profile you (Search).
Give each service its own email alias, so leaks and spam can be traced and cut off (Email).
Trim app permissions, turn off location history, and turn off ad tracking and the advertising ID in your phone's privacy settings (Operating systems).
Ask data brokers to delete your data. Californians can send one free request to more than 600 registered brokers through the state's DROP service; elsewhere, data protection laws such as the GDPR may give you a right to deletion (OSINT defense).
Check what your TV, speakers and doorbell send home (Smart home), and think before typing personal details into AI chatbots (AI).
You probably do not need Tor, Tails or burner phones. A VPN mainly moves trust from your internet provider to the VPN company (VPN).

Journalist protecting sources

Protecting: the identity of sources, unpublished material, and your own accounts and location. From: the subjects of your reporting, police and courts that can demand records or search your home, border officers, governments that buy spyware, and online harassers. Likelihood: rises sharply with the sensitivity of the story. Impact: a source can lose their job, their liberty or worse. Willing to do: a lot, as long as it fits around deadlines.

Move source conversations to Signal with disappearing messages, share a Signal username instead of your number, and set phone number discovery to Nobody (Freedom of the Press Foundation, Messaging). In September 2026 Signal began testing sign-up with no phone number at all, for a small one-time fee, in its Android beta (FPF).
Metadata (who contacted whom, and when) survives encryption and can be demanded from carriers and platforms (FPF on metadata, Metadata, Phones and numbers).
Keep less. Encrypt every device, use an alphanumeric passcode, consider turning off face and fingerprint unlock, and power devices off when you are not using them. FPF published this advice in January 2026 after the FBI searched a Washington Post reporter's home (FPF raid guide, Encryption). A leaked law-enforcement tutorial video suggests Graykey forensic tools can get around the iPhone's automatic restart after 72 hours locked, so switching the phone off yourself is the safer habit (FPF).
Travel with only the devices and data you need. At the US border, officers often need no suspicion to search a phone, and non-citizens who refuse can be turned away (FPF). Wiping a phone during a search can itself lead to charges: US prosecutors charged an activist with destroying property to prevent its seizure after he allegedly entered a phone-wiping "duress" passcode at an airport; he has pleaded not guilty (FPF).
Receive documents through SecureDrop or a similar system, and strip hidden metadata from files before publishing them (Metadata).
Install updates immediately and consider Lockdown Mode (iPhone) or Advanced Protection (Android). In 2025 Citizen Lab confirmed Paragon's Graphite spyware on European journalists' iPhones, delivered by a zero-click iMessage attack that iOS 18.3.1 fixed (Citizen Lab, Operating systems).
Keep reporting and personal identities apart, and remove your home address from people-search sites before a big story runs (Separate identities, OSINT defense).

Leaving an abusive partner or dealing with a stalker

Protecting: your physical safety and location, conversations with the people helping you, your accounts, money and evidence. From: someone who may know your passwords and security answers, has handled your devices, shares accounts or a family plan with you, and can use stalkerware, hidden trackers or people-search sites. Likelihood and impact: both high. Willing to do: whatever is safe, at a pace that does not tip the other person off.

Work out a safety plan with a local advocate, and keep a log of incidents: a documented pattern can matter to police and courts (NNEDV Safety Net).
From the safer device, change passwords and security questions, sign out other sessions, and check recovery email addresses, phone numbers and linked devices (Passwords).
Review location sharing, family sharing, shared photo albums and shared cloud accounts. On iPhone, Safety Check (iOS 16 and later) shows and resets what you share (Apple Personal Safety guide).
Watch for Bluetooth trackers. iPhones and recent Android phones alert you to some unknown trackers, but not every brand; the open-source AirGuard app detects more (EFF).
Stalkerware often shows no obvious signs. The most common clue is the other person knowing things they should not; on iPhone, iCloud Backup switched on without your knowledge is another. Removing it deletes evidence and may be noticed (Coalition Against Stalkerware).
On Android 16 and later, the optional intrusion logging in Advanced Protection keeps records of app installs that can later reveal stalkerware, but only from the moment it is turned on (Coalition Against Stalkerware).
Remove your address from people-search sites and ask friends not to share it. Many US states run address confidentiality programs for survivors (OSINT defense).
Consider new accounts and a new number never linked to the old ones, and check cars and smart home devices the other person can still control (Phones and numbers, Smart home).

Activist facing a hostile government

Protecting: the identities of fellow organisers, plans, contact lists, your location and your freedom. From: a state that can demand data from local companies, monitor phone networks, seize and search devices, send targeted phishing or spyware, and plant informants. Likelihood: high once you are visible. Impact: arrest, or harm to others. Willing to do: a lot, but a group is only as careful as its least careful member.

Keep your activist identity apart from your legal one: separate accounts, no reused usernames or photos, and phone numbers not tied to your name where that is legal (Separate identities, Phones and numbers).
Use Signal or SimpleX with disappearing messages, keep groups small, and check linked devices regularly. Russian state-linked groups have used fake group invites and QR codes to link their own devices to targets' Signal accounts (Google Threat Intelligence, Messaging).
Assume companies in your country will hand over what they hold. Prefer services outside the government's reach, and use Tor or a trusted VPN for blocked sites, after checking whether these tools are restricted where you live (VPN, Browsers, DNS).
Before a protest, encrypt your phone, use a long passcode and turn off face and fingerprint unlock, or leave the phone at home (EFF: Attending a Protest, Encryption).
Blur faces and strip location data from photos before posting them (Metadata).
Turn on Lockdown Mode or Android Advanced Protection, and install updates the day they arrive (Operating systems).
Pay for tools and hosting in ways not tied to your bank account where that is legal, for example cash or Monero (Crypto, Server hosting).
If you suspect a compromise, get expert help. The Access Now Digital Security Helpline is free and runs around the clock for civil society (Digital forensics).

Baseline: what everyone should do first

These steps protect against the most common threats in almost every threat model, cost little or nothing, and make the specialised tools in the other guides worth using. They are in rough order of impact.

Turn on automatic updates for your operating system, browser and apps. Attackers routinely use bugs that already have fixes: CISA's catalog of known exploited vulnerabilities lists more than 1,700 that have been used in real attacks. Replace devices that no longer get security fixes. Windows 10 support ended on 14 October 2025; home PCs only get security updates until 12 October 2027 if enrolled in Extended Security Updates (Operating systems).
Use a password manager so that every account has a long, random, unique password (Passwords).
Add a second factor, strongest first. Passkeys and hardware security keys resist phishing; authenticator apps come next; SMS codes are the weakest option. Start with your email, phone carrier, Apple, Google or Microsoft account, bank and password manager (Passwords).
Lock and encrypt your devices. Use a long passcode rather than a four-digit PIN or a pattern. Modern phones encrypt their storage, and the passcode is what protects it. On computers, turn on FileVault, BitLocker or Windows Device Encryption, or LUKS on Linux. If you sign in to Windows with a Microsoft account, Device Encryption stores a copy of the recovery key in that account (Microsoft, Encryption).
Protect the accounts that can reset everything else: your main email address and your phone number. Set an account or port-out PIN with your carrier, keep recovery codes offline, and remove SMS as a recovery option where you can (Email, Phones and numbers).
Back up what you cannot afford to lose. Keep at least three copies on two kinds of storage with one away from home, encrypt them, and test a restore. Ordinary cloud backups can often be read by the provider; Apple's Advanced Data Protection fixes that for iCloud, but Apple stopped offering it to new users in the UK in 2025 (Apple, Cloud storage).
Fix your browser. Use one that blocks trackers, add a content blocker, and keep other extensions to a minimum: many can read and change every page you visit (Browsers, Search).
Learn the current phishing tricks described below, and never act on a link, number or QR code that arrives in an unexpected message.
Separate your identities. Use different email aliases, phone numbers and payment cards for different parts of your life, so that one leak does not tie them all together (Email, Virtual cards, Separate identities).
Move private conversations to end-to-end encrypted messengers, where only the people in the conversation can read the content (Messaging).
Find out what is already exposed. Have I Been Pwned shows which of the more than 1,000 breaches it tracks include your email address. Search for your name and address on people-search sites too (OSINT defense).
Review app permissions and location sharing every few months, and after installing new apps (Operating systems, Metadata).

Phishing: tricks to know

Phishing means tricking you into handing over a password or code, opening malware, or doing something on an attacker's behalf. Adversaries of every kind use it, from scammers to intelligence services. Current techniques include:

Real-time fake login pages. A look-alike site passes your password and one-time code to the real site within seconds. Passkeys and security keys resist this because the browser will not use them on the wrong domain (EFF).
Fake "verify you are human" steps (ClickFix). A page shows a fake CAPTCHA or error and tells you to paste a command into the Run box or a terminal. Microsoft reported in August 2025 that this was being used to install password-stealing malware on Windows and macOS (Microsoft). No legitimate site asks you to do this.
Impersonation with cloned voices. In May 2025 the FBI warned that, since April, attackers had been sending texts and AI-generated voice messages impersonating senior US officials in order to take over accounts (FBI). Call back on a number you already have, and agree a code word with family.
Malicious QR codes and invites. A fake group invite or "security alert" can link an attacker's device to your messenger account, so they receive your messages without touching your phone (Google Threat Intelligence). Check the linked devices list in your messengers from time to time.
Pressure. Urgency, secrecy, or requests for gift cards, cryptocurrency or a code "sent by mistake" are warning signs, whatever the channel.

One habit defeats most of these: when a message asks you to act, go to the site or app yourself, or contact the person through a channel you already trust. A password manager that refuses to fill in a password is also a useful warning that the site is not what it claims.

Common mistakes

Choosing tools before behaviour. In March 2025 the US national security adviser accidentally added The Atlantic's editor-in-chief to a Signal group discussing planned strikes in Yemen (CBS News). The encryption worked; the member list was wrong. In August 2025 an outsider was added to a law-enforcement group text about a manhunt, over unencrypted MMS (404 Media).
A single point of failure. One email address that resets every account, one phone holding every 2FA code, one password vault with no backup. In July 2026 FPF reported that someone had taken over The Intercept's published Signal tipline username and used it to impersonate the outlet; possible causes include a lapsed account, a username change or a SIM swap (FPF).
Convenience creep. Protections erode one exception at a time: turning cloud sync back on, signing in to a personal account in a hardened browser, granting location access "just this once", or backing up encrypted chats to an unencrypted cloud.
Inconsistent habits. Privacy measures have to be used every time. One login without Tor, one photo posted from your real account, or the same turn of phrase in two identities can link them permanently (Separate identities).
Reusing usernames, avatars and bios. Free tools such as Sherlock check a username across more than 400 sites. Give each identity its own name, picture and writing style (OSINT defense).
Copying someone else's threat model. An activist's setup would exhaust most people, and an everyday setup would fail an activist. Advice built for a different adversary either wastes your effort or leaves gaps.
Standing out. Rare browser settings and unusual tools can make you easier to recognise. Privacy tools work best when many people use them with the same settings (Browsers).
Handing over data you do not have to. Every copy can leak. In October 2025 Discord said about 70,000 users' government ID photos, submitted for age-check appeals, may have been exposed through a breach at a customer-service vendor (Discord).
Ignoring the physical and human side. An unlocked laptop, someone looking over your shoulder, a shared family computer or a friend tagging you in a photo can undo good software.
Trusting marketing. "Military-grade encryption" and "anonymous" are claims, not evidence. Look for published source code, independent audits and a track record (VPN).

Revisit your threat model

A threat model is not a one-off exercise. Go through the questions again when your life changes (a new job, a break-up, a move, travel abroad, a sensitive project) and when the tools change under you. Recent examples:

Instagram removed the option for end-to-end encrypted direct messages on 8 May 2026, so new direct messages there are no longer end-to-end encrypted (NNEDV Safety Net).
Apple no longer lets UK users turn on Advanced Data Protection, so new UK users' iCloud backups are not end-to-end encrypted, and existing users have been told they will need to turn it off (Apple).
Windows 10 reached end of support in October 2025. Without enrolment in Extended Security Updates it receives no security fixes (Microsoft).
Services get sold, change their terms or shut down. Each tool guide on this site notes changes like these as they happen.

Where to get help

If you think you are being targeted, talk to people who handle these cases every day. Outside the US, look for a national domestic violence or victim support service; local advocates know local law.