Vaughn outlines a four question approach to threat modelling

Lora Vaughn, a cybersecurity expert and founder of The Vaughn Group, presents a concise four-question threat modeling exercise pitched at CISOs and security teams. Speaking at ISC2 Strategic Congress in Denver, Vaughn argues that a simple whiteboard approach can yield a practical roadmap for security investment without the cost of a full 200-page threat model.

She emphasises that the four questions—focused on potential impact, likely attackers, overlap between worst-case scenarios and attacker targeting, and the cheapest effective controls—can guide prioritisation and budgeting in a wide range of organisations, from national security bodies to SMBs. Vaughn also warns that handing enterprise security to an AI model is unrealistic and that threat models require ongoing maintenance, suggesting quarterly refreshes or updates after major changes.

The article outlines Vaughn’s four questions and how to apply them in practice. It asks what would hurt most on a given Monday, and how to rank those risks as existential, painful, or annoying. It then probes who would target the organisation and where those two lists intersect to define scenarios in a compact form: who, how, what, and cost.

For controls, Vaughn recommends prioritising free or low-cost measures such as MFA, maintaining an asset inventory, patching exploited bugs, and, for ransomware, combining backups with network segmentation. She stresses that none of these are vendor SKUs and encourages management engagement to align spending with business outcomes, offering practical options and a paper trail to support decisions. Vaughn concludes that the threat model is an ongoing cycle, to be refreshed regularly.