Build a Threat Model Before You Buy Anything

A threat model is just four written answers: what you are protecting, who you are protecting it from, what happens if they get it, and how much inconvenience you will accept. Write those down and most security-shopping questions answer themselves, including whether you need a VPN at all. Skip them and you end up buying tools by advertising volume, which is how people acquire a subscription that does nothing about the thing they were actually worried about.

The method below takes about fifteen minutes and is the single most useful thing on this site.

Step 1: name the asset

Be specific. “My privacy” is not an asset; it is a category. Assets look like:

• the list of websites I visit
• the contents of my messages with a particular person
• my home location
• access to my bank account
• the fact that I read a particular publication
• documents on my laptop
• my real name, in connection with a pseudonymous account

Different assets have completely different defences, and a single tool almost never covers several of them. Writing the asset down is what stops you buying a network tool to protect a file.

Step 2: name the adversary

This is the step people skip, and it is the one that decides everything. An adversary is a specific party with a specific vantage point:

The network operator. The café, the hotel, the airport, a landlord, a workplace network.

Your internet provider. Sees destinations, may retain them, may be compelled to produce them.

The sites and apps you use. They see what you do while you are using them, and they know who you are once you log in.

Advertising and analytics networks. Embedded in the pages themselves.

Someone with access to your device. A partner, a housemate, a colleague, a thief.

A criminal, opportunistically. Phishing, credential stuffing, malware, fraud.

A civil litigant or a law-enforcement process. Operating through legal demands rather than technical means.

A state with serious capability. A category of its own, and the one where consumer tools stop being adequate.

For each adversary ask: where do they sit? A defence only works if it is between the adversary and the asset. That single question resolves most VPN confusion — the tunnel sits between your device and the network, so it addresses the first two adversaries on this list and structurally cannot address the rest. What a VPN protects against is that mapping in full.

Step 3: name the consequence

What actually happens if the adversary succeeds? Rank it honestly:

• Annoyance — more targeted advertising, a slightly creepier feed.
• Money — fraud, account takeover, a fraudulent transfer.
• Embarrassment or social harm — something private becoming known to people you know.
• Professional harm — a client’s confidence breached, employment consequences.
• Legal harm — exposure in a proceeding.
• Physical danger — the category where you should stop reading consumer blogs and get specialist help.

The consequence sets your budget of effort. Most people’s honest answer for most assets is “annoyance”, which is worth knowing before you spend a weekend on it.

Step 4: name your tolerance

Every measure costs something: money, speed, convenience, occasional broken services, extra verification steps at your bank. A defence you abandon after a fortnight provides nothing. Decide in advance what you are actually willing to live with, and prefer measures that keep working when you stop paying attention — defaults, blockers, a password manager — over measures that require discipline every time.

Worked example: the usual case

Asset: the list of sites I visit. Adversary: the coffee shop’s network and my ISP. Consequence: low, but I dislike it. Tolerance: a small monthly cost, no significant slowdown.

A VPN is a good fit here. It sits exactly between that adversary and that asset. The correct expectation is metadata hiding on untrusted networks, as what a VPN changes on public Wi-Fi describes — and the correct follow-up question is whether you prefer the provider holding the list to your ISP holding it, which is what your VPN provider can see.

Worked example: the mismatch

Asset: freedom from targeted advertising. Adversary: advertising networks. Consequence: annoyance.

A VPN is the wrong tool, because the adversary is inside the pages you load, not on the wire. A content blocker and fewer logins do the work. Buying a subscription here is the classic mis-purchase, and why a VPN does almost nothing about ad tracking is the long version.

Worked example: the serious case

Asset: the identity of a source. Adversary: a government with technical capability and legal authority over infrastructure. Consequence: severe harm to another person.

Stop. No consumer subscription is an answer to this. The right step is advice from organisations that specialise in protecting people in this position — press freedom groups, digital rights organisations, and the security staff who support them — and tooling built for anonymity rather than convenience. Please read why a commercial VPN isn’t enough against a state adversary before making any decision, and do not let a purchase substitute for advice.

Keeping it honest

Two failure modes to watch for.

Threat-model inflation. Adopting the practices of a high-risk profession when your actual risk is commercial annoyance produces expense, friction, and a false sense of coverage — and a very distinctive configuration, which is its own problem.

Threat-model denial. Deciding you are uninteresting and doing nothing, when the cheap universal measures — a password manager, multi-factor authentication, patched software — pay off for everyone regardless of who is watching.

Write the four answers down. Revisit them when your circumstances change: a new job, a move, a new jurisdiction, a change in who shares your network. The model is what turns a product decision into a reasoned one, and it is the reason this site talks about mechanisms rather than recommendations.