Build a Simple Privacy Threat Model Before Choosing a VPN

Most people pick a VPN the way they pick a coat: they look at what is popular, check the price and hope it fits. A better way is to ask what weather you are dressing for. In security, that question is called a threat model, and it is simpler than it sounds.

A threat model is a short, honest description of what you are trying to protect, who you are protecting it from and how much effort that is worth. Once you have one, choosing a VPN stops being guesswork. You can see which risks a VPN reduces, which it leaves alone and what else you should do next to it. This article walks through a five-question version, with examples you can adapt. It is general information and does not replace professional help for people at serious risk.

What a threat model is, and why do it first

A threat model is a way of thinking, not a tool you install. The Electronic Frontier Foundation's Surveillance Self-Defense guide builds its advice around the same idea: security is not one product, it is a plan matched to your situation.

Doing it before you choose a VPN pays off in three ways:

• You avoid overbuying. If your main risk is other people on café Wi-Fi, you do not need the same setup as someone facing a determined, well-resourced adversary.
• You avoid false comfort. A VPN fixes some problems and not others. Knowing the gap keeps you from assuming you are covered when you are not.
• You spend effort in the right place. Often the most valuable step is a strong password and two-factor authentication, not a new app.

The five questions

The EFF guide frames a security plan around five questions. In plain language:

1. What do I want to protect? Your accounts, messages, photos, location, browsing history, files or money.
2. Who do I want to protect it from? People on the same network, a network operator, advertisers, criminals, a nosy acquaintance or someone with more resources.
3. How likely is it that I will need to protect it? A common risk deserves more attention than a rare one.
4. How bad are the consequences if I fail? Losing a social media account is not the same as losing banking access or exposing someone's safety.
5. How much trouble am I willing to go through to prevent those consequences? A plan you will not follow is not a plan.

Keep your answers short. A page, or even a few lines, is enough.

Step 1: list what you want to protect

Start with a concrete list. Do not skip the boring items, because they are often the ones attackers want.

What you protect	Example	Why it might matter
Account logins	Email, banking, social media	An email account can reset many others
Private messages and files	Chats, documents, photos	Personal or professional sensitivity
Browsing habits	Sites you visit, searches	Profiling by advertisers or network operators
Location and routine	Home, work, travel plans	Personal safety and privacy
Money and identity	Card details, ID numbers	Fraud and identity theft
Work information	Client files, internal tools	Obligations to an employer or clients

Then mark the two or three items that would hurt most if they were exposed. Those drive your decisions.

Step 2: name who you are protecting it from

Think about who could realistically see or reach your data. Most people's list is more ordinary than they expect. This table shows common parties, what they can typically see, and how a VPN relates.

Who	What they might see	Does a VPN help?
Other users on the same Wi-Fi	Unencrypted traffic and which services you connect to	Yes. Traffic between your device and the VPN server is encrypted. See public Wi-Fi safety.
The Wi-Fi owner (café, hotel, airport)	Destinations and timing of your connections	Largely yes for destinations, since they see only the VPN connection
Your internet provider	Domain names and traffic volumes	Partly. It sees the VPN link, not the sites inside it
Websites and advertisers	Your IP address, cookies, account activity	Only the IP address part. Logins and cookies still identify you
Criminals who phish you	Anything you type into a fake page	No. Phishing needs careful habits and two-factor authentication
Someone with access to your phone or laptop	Everything on the device	No. Use a screen lock and device encryption
The VPN provider itself	Traffic passing through its servers	A VPN moves trust to the provider. Choose carefully
A well-resourced, targeted adversary	Potentially a great deal	A consumer VPN is not enough. A broader plan and expert help are needed

Notice that the VPN provider appears on the list. A VPN does not remove the observer, it changes who the observer is. That is why trust belongs in the model. For the full picture of the limits, read what a VPN cannot protect you from.

Step 3: weigh likelihood and consequences

Not every risk deserves the same effort. A simple way to rank them is to score each risk from 1 (low) to 3 (high) for likelihood and for impact, then multiply.

Risk	Likelihood	Impact	Score	Reasonable response
Someone snoops on public Wi-Fi	2	2	4	Use a VPN, prefer HTTPS sites
Phishing steals a password	3	3	9	Two-factor authentication, careful habits
Phone is lost or stolen	2	3	6	Screen lock, device encryption
Advertisers build a profile	3	1	3	Browser privacy settings, tracker blockers
Targeted attack by a powerful party	1	3	3	Specialist advice, broader security plan

Your numbers will differ. The point is the ranking. In this example, phishing and a lost phone outrank public Wi-Fi snooping, so a VPN alone would be an odd place to start. Two-factor authentication is a more valuable first step. See what is two-factor authentication and the CISA guide to moving beyond a password.

Worked examples

A student on campus Wi-Fi. She protects email, university portals and social accounts, mainly from other users on the shared network and from phishing. Likelihood is moderate and impact is modest. A VPN on shared networks plus two-factor authentication is a proportionate plan. She also follows the campus network rules.

A frequent traveller. He protects banking, work email and client files while moving between hotels and airports. The main risks are untrusted networks and device theft. A VPN on public Wi-Fi, a screen lock, device encryption and updated software cover most of it. He also keeps backups, so a stolen laptop is an inconvenience, not a crisis.

A remote worker. She handles client documents at cafés. Her risks are public networks, phishing and shared accounts. A VPN helps on public networks, but her employer's access rules come first, and she uses strong, unique passwords and two-factor authentication on every work account.

A journalist or other person facing serious risk. Here the stakes and the capability of adversaries may be much higher. A consumer VPN is one small layer and does not make a person anonymous or safe. People in this position should build a wider plan: separate accounts, hardened devices, careful handling of sources and files, and support from trained digital security organisations. The EFF guide has sections written for exactly this audience, and it is the right place to begin. This article does not offer advice on avoiding lawful investigation, and a VPN should never be treated as protection from it.

Where a VPN fits in your plan

Once you have your list, match controls to threats. A VPN is strong on a narrow set of problems.

Threat	Useful controls
Snooping on shared or public networks	VPN, HTTPS, avoiding sensitive logins on unknown networks
Account takeover	Unique passwords, a password manager, two-factor authentication
Phishing	Checking links and senders, never entering credentials from a message link
Lost or stolen device	Screen lock, device encryption, remote wipe, backups
Tracking by sites	Browser privacy settings, tracker blocking, limiting logins
Outdated software	Prompt updates for the system, browser and apps

A VPN also helps keep your network operator from seeing every site name you visit, but it does not stop an account you are logged into from recognising you. For the difference between hiding an address and being anonymous, see can a VPN make you anonymous.

Turn the model into a VPN choice

With your model in hand, the choice becomes a matter of fit.

1. Is a VPN relevant? If your main risks are on untrusted networks or about your provider seeing your browsing, yes. If they are phishing or device theft, a VPN is secondary.
2. How much do you trust the provider? Read what the provider publishes about its practices instead of relying on slogans. Be sceptical of absolute promises.
3. What do you need it for? A VPN you will use on travel days differs from one you want running all day.
4. Does it work on your devices? Check that the apps and connection methods cover the phones and computers you use.
5. Can you stop easily? Some people prefer a fixed-term pass they buy only when needed rather than a service that renews automatically. Compare options in how to choose your first VPN.

Common mistakes

• Starting with the product. Choosing an app first and inventing reasons later.
• Treating a VPN as a force field. It protects one path, not your whole life online.
• Ignoring the basics. Reused passwords and no two-factor authentication create more risk than public Wi-Fi does.
• Copying someone else's model. A friend's risks may be very different from yours.
• Never updating the model. New jobs, trips and devices change your risks.
• Hiding illegal acts. A threat model is for privacy and safety, and the law still applies to everything you do.

Summary

A threat model is a short answer to five questions: what you protect, from whom, how likely the risk is, how bad it would be, and how much effort you will invest. Once you have it, a VPN becomes one tool with a clear job, typically protecting traffic on networks you do not control and limiting what your network operator sees. It leaves phishing, weak passwords, lost devices and tracking by accounts untouched. For people facing serious or targeted risks, a consumer VPN is not enough, and broader help such as the EFF guide is the right next step. Review your model whenever your situation changes.

If a VPN fits your model, you can see how a prepaid pass works.