What is a threat model in information security, and which activity is typically performed first?

• A. A threat model is a structured representation of potential threats to a system.
• B. Define mitigations first.
• C. Assess risk first.
• D. Enumerate threats first.

Answer: (A)

A threat model is a structured representation of potential threats to a system. This definition captures the essential idea: you’re not just listing dangers, you’re organizing them into a formal model that helps you reason about what could go wrong, which assets need protection, who or what might threaten them, and what defenses are appropriate. Framing threats in a structured way makes it possible to analyze tradeoffs, prioritize mitigations, and communicate security concerns clearly to stakeholders.

In practice, threat modeling typically starts with identifying what needs protection and then outlining the threats that could affect those assets. This early step of enumerating threats is a natural part of building the model, but the best single description of what a threat model is remains the structured representation of those potential threats. The other choices describe actions within the process or mischaracterize the concept, so they don’t define what a threat model is as precisely.