---
title: "Two Scenario Threat Modeling"
url: https://daily.dev/posts/two-scenario-threat-modeling-jwxkbtk5m
source_url: https://jacobian.org/2025/aug/8/two-scenario-threat-modeling
type: article
source: "Jacob Kaplan-Moss"
published: 2026-07-01T15:21:34.623Z
updated: 2026-07-01T15:21:53.679Z
tags: ["security"]
reading_time: 7
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Two Scenario Threat Modeling

**[Jacob Kaplan-Moss](https://daily.dev/sources/jacobian)** · 7 min read · 0 upvotes · 0 comments

## Summary

A practical approach to threat modeling that overcomes the paralysis of trying to be exhaustive. Instead of attempting to enumerate every possible risk, the technique involves crafting just two specific scenarios: a worst-case scenario (high impact, even if unlikely) and a most-likely scenario with tangible impact. Both scenarios should be written as detailed narratives rather than abstract categories, leveraging humans' natural affinity for storytelling. Drawing a parallel to Nielsen's usability testing research, even a single scenario yields significant insight, with rapidly diminishing returns after a few. The entire exercise can be completed in under a day and produces a threat model that teams can actually remember and act on.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://jacobian.org/2025/aug/8/two-scenario-threat-modeling>

## Similar posts on daily.dev

- [Scenario-Based Cyber Risk Quantification Explained \| Kovrr](https://daily.dev/posts/scenario-based-cyber-risk-quantification-explained-kovrr-rd2horwjw) · Security Boulevard · 0 upvotes · 0 comments
- [Soatok’s Informal Guide to Threat Models](https://daily.dev/posts/soatok-s-informal-guide-to-threat-models-bf3d13k87) · Dhole Moments · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security)

[View this post on daily.dev](https://daily.dev/posts/two-scenario-threat-modeling-jwxkbtk5m)