· ai-devtools
Threat Modeling With 4 Simple Questions on a White Board
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.
ISC2 Strategic Congress 2026 — Denver — A threat model should be a starting organizing principle for any security program. But rather than investing in a 200-page high-dollar threat model report, one longtime chief information security officer (CISO) argues that "four questions on a white board," can provide any team with an actionable plan forward. Lora Vaughn, cybersecurity expert, former CISO, and now founder of her own consulting firm, The Vaughn Group, said that over her many years leading cybersecurity programs, she has developed a wickedly simple four-question threat modeling exercise that can be used in a wide range of organizations, be it the "National Security Agency (NSA) or your friendly neighborhood small-to-medium business (SMB)."
The answers, she said, can then offer a road map for investment decisions. That requires further exploration, she acknowledges, given there's always a new technology right around the corner that promises to drive down the cost of cybersecurity investment in enterprises. And reality must be balanced with industry hype. Related:Rethinking Cybersecurity Awareness in the AI Era For instance, around 2015, the move to the cloud was supposed to put the onus on providers like AWS to protect enterprises.
