Threat Modeling for Small Businesses: A Practical Workshop
Identify critical assets, trust boundaries, realistic threats, and prioritized controls in a focused small-business workshop.
Choose a workflow
Start with customer sign-in, invoice payment, order fulfillment, or remote access. Identify the data, services, users, and business outcomes at risk.
Map components and boundaries
Sketch applications, APIs, identity providers, databases, payment services, administrators, and third parties. Mark where data crosses organizational or privilege boundaries.
List plausible threats
Consider account takeover, fraud, unauthorized data access, disruption, misconfiguration, supplier compromise, and accidental disclosure. Use structured prompts to avoid focusing only on familiar scenarios.
Prioritize by impact
Document affected assets, preconditions, current controls, consequences, and uncertainty. Rank risks consistently and explain the business rationale; scores are decision aids, not precise predictions.
Assign and revisit actions
Give each mitigation an owner, due date, and verification method. Revisit the model after material changes or incidents.