A personalized OPSEC score, the vulnerabilities the score reveals, and the exact articles to close each one. Runs entirely in your browser. No account. No data collection.
Want the method instead of the tool? Read how to build a threat model in 20 minutes. Want the definition first? See the glossary entry.
Frequently asked questions
Should I use this builder or read the article instead?
Both. The builder gives you a personalized result in three minutes for your specific profile, your assets, your adversaries, and your current setup. The article on how to build a threat model in 20 minutes explains the method that powers it, and is the right read if you prefer to think through the questions on paper before using any tool.
Is this Threat Model Builder free?
Yes. The builder runs entirely in your browser. No account, no email, no payment, no tracking. Your answers are not transmitted, logged, or stored anywhere. Once the page has loaded, you can disconnect from the internet and the tool still works.
How is this different from Microsoft Threat Modeling Tool or OWASP Threat Dragon?
Those tools are designed for software architects modeling application threats: data flow diagrams, STRIDE categories, mitigation libraries for code-level vulnerabilities. This builder is designed for individuals modeling personal exposure: a journalist with sources, a lawyer with privileged communications, a parent in a custody dispute, a deployed family with social media exposure.
Why are data brokers in the questionnaire?
Data brokers aggregate your home address, phone numbers, family members, vehicle registration, and behavioral history into commercial databases. For most adversary models, broker data is the cheapest entry point. Removing yourself from broker databases closes more attack surface in two weeks than most security tools close in a year.
Will my answers be saved if I close the page?
No. By design. The promise of zero storage is incompatible with persistence. If you want to keep your result, copy it to your clipboard or print it from the result screen.