Threat Modeling With 4 Simple Questions on a White Board
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.
ISC2 Strategic Congress 2026 — Denver — A threat model should be a starting organizing principle for any security program. But rather than investing in a 200-page high-dollar threat model report, one longtime chief information security officer (CISO) argues that “four questions on a white board,” can provide any team with an actionable plan forward.
Lora Vaughn, cybersecurity expert, former CISO, and now founder of her own consultant firm, The Vaughn Group, said that over her many years leading cybersecurity programs she has developed a wickedly simple four-question threat modeling exercise that can be used in a wide range of organizations, be it the “National Security Agency (NSA) or your friendly neighborhood small-to-medium business (SMB).”
The answers, she said, can then offer a road map for investment decisions. That requires further exploration, she acknowledges, given there’s always a new technology right around the corner that promises to drive down the cost of cybersecurity investment in enterprises. And reality must be balanced with industry hype.
For instance, around 2015, the move to the cloud was supposed to put the onus on providers like AWS to protect enterprises. What came next was a flood of misconfigurations and misunderstandings about who owned which part of security. By 2018, the buzzword was “automation.” But teams quickly learned that automating anything required defining buttoned-downed processes first — often a prohibitively time-consuming exercise that pushed many of these project timelines out. By 2021, zero-trust networks were on everyone’s mind. But that turned out to be less of a prescription and more of a customizable, guiding principle; and, architecting a true zero-trust environment requires a big investment in systems that would prove to be a much longer journey than many in the sector had hoped.
And regarding the current zeitgeist, handing over enterprise security to an agentic AI model is a “fantasy,” according to Vaughn, speaking from the stage while presenting her four-question threat model at ISC2 Strategic Congress in Denver this week.
“AI is a force multiplier,” Vaughn said. “It just multiplies what you already have. Zero times anything is still zero. Math is undefeated.”
Bottom line: Once the threat modeling is done, choose your path wisely, and with your eyes wide open. And recognize that it’s an ongoing cycle. “Refresh the threat model quarterly,” Vaughn added. “Or after any big change.”
Threat Modeling With 4 Questions on a White Board
What would hurt most on Monday?
Ask yourself, if you walked into work on 8 a.m. Monday morning, what would be the worst case scenario(s)? For example, is it a ransomware attack that could result in the leak of sensitive information? What about one that locks up production systems? Mass pwning of firewalls and edge devices? What about a business email compromise (BEC) that results in a $100,000 bank transfer to attackers? Would falling for the North Korea fake worker scheme cause big problems?
Vaughn stressed that once identified, these should be ranked by pain to the business. She added, five to eight “painful” items are a reasonable number to determine.
Vaughn ranks risk in three categories: existential, painful, and annoying. Existential risk means that a breach would close the doors of the business. Painful risk equates to business disruption with associated costs and bad press. Annoying risk is something that can be fixed semi-easily.
Who actually attacks an organization like yours?
A key piece of determining your risk profile is understanding who sees you as a target. Do state-sponsored advanced persistent threat (APT) groups have your organization in their sights? Or is your business most likely to be targeted by BEC scams? Are ransomware affiliates trying to find a way into your systems? Do you have a large inventory of software or appliances that are high on attackers’ hit lists? How is your patching hygiene, and do you have bugs that are known to be exploited?
This type of intel is free and available from sources like the Cybersecurity and Infrastructure Security Agency (CISA), but can also come from private threat intelligence services. Vaughn recommended that CISOs and security leaders lean on their vertical Information and Analysis Centers (ISACs) as well.
“That’s your most valuable resource,” Vaugh said. “And it’s free.”
Where do the first two lists overlap?
Items that fall between both the “worst-case scenario” and “who’s targeting you” lists are where teams need to start first. “Every overlap is a scenario,” Vaughn explained. “Write one sentence for each: who, how, against what, and costing what?”
What is the cheapest control that breaks the attack scenario?
In terms of a BEC attack, Vaughn pointed out a simple phone call verification could be the most effective prevention, and it costs nothing. “Find where the attack stops for the least money,” Vaughn advised. “Spend in that order.”
Additional free controls that actually work, according to Vaughn, are multifactor authentication (MFA) everywhere, which is something she adds is “non-negotiable” and urges CISOs to “fight for.” An asset inventory is also invaluable, even if it’s just a spreadsheet, and of course it “beats doing nothing.” Patching bugs that have already been exploited, resisting the urge to give everyone admin credentials, and testing backups also make the list. And for ransomware, having backups isn’t enough; network segmentation has to go along with it.
“If you can’t restore from backups, or you don’t have backups, you have hope,” Vaughn said. “Hope is not a control.”
She pointed out that nothing on this list of controls can be bought from a vendor. “There’s no SKU for ‘turn on MFA’ and ‘keep a spreadsheet,'” she added.
Taking the Threat Model Findings to Management
It might be tempting for cybersecurity teams to try and tackle these four questions on their own, but Vaughn said that including management in these conversations will help better align priorities to the broader business, and will help management understand the potential fallout of not taking care of cybersecurity.
There are some best practices for doing this; for instance, Vaughn recommends linking spend to a business outcome: “If nobody funds a CVE, we stop shipping for a week,” is one example she offered.
She also recommends bringing three spend options, with prices attached, and then making a recommendation for one. Additionally, Vaughn said CISOs and cyber teams should never promise “security,” only reduced risk, and discuss investment decisions from that lens.
Offer, say, options that cost “$12K, $4K, or zero,” she explained. “Zero means we accept the risk, so I recommend the $4K.”
And once the decision is made, Vaughn suggested an email follow up like, “Confirming we’re deferring X and accepting the risk of Y. Tell me if I got that wrong.” That paper trail can prove invaluable following a compromise, she said.
Read more about:
