The Book of Threat Models

#threat-models #security #realism

I. Purpose

This text exists to remove ambiguity.

Power is concrete. It moves through incentives, leverage, and enforcement, not through ideology alone.

This book documents patterns rather than speculating.

Preparedness begins with clarity.

II. What a Threat Model Is

A threat model is accounting under pressure, not fear dressed up as rigor.

It answers three questions:

Anything not in the model is noise.

Optimism without modeling is negligence.

III. State Coercion

The state rarely begins with force.

It begins with:

Force is reserved for those who remain legible and immobile.

Coercion scales through bureaucracy more often than violence.
Its preferred tools are delay, uncertainty, and cost.

The objective is control. Punishment is only one instrument inside it.

IV. Corporate Capture

Corporations rarely oppose the state. They integrate with it.

Capture occurs when:

Corporate power is delegated rather than independent.

Threat models that ignore this layer are incomplete.

V. Social-Layer Attacks

Most systems fail socially before they fail technically.

Social-layer attacks include:

These attacks do not require law.
They require coordination.

The goal is isolation. Refutation is optional.

VI. Regulation as Narrative Warfare

Regulation is rarely neutral.

It is framed as:

Language precedes enforcement.

By the time rules are debated, the narrative has already assigned guilt and virtue.

Compliance becomes a moral obligation.
Noncompliance becomes deviance.

VII. “Consumer Protection” as Control

Protection implies vulnerability.

When individuals are framed as incapable, intermediaries are justified. When intermediaries exist, custody shifts. When custody shifts, leverage emerges.

Consumer protection, in practice, often protects systems from exit more effectively than it protects consumers.

The cost of protection is sovereignty.

VIII. Escalation Patterns

Power escalates predictably.

  1. Observe
  2. Register
  3. Regulate
  4. Restrict
  5. Enforce

Each step appears reasonable in isolation.
Together, they form containment.

Threat models must account for sequence, not just events.

IX. What This Book Does Not Do

This book does not predict timelines, name enemies, or recommend confrontation.

Paranoia assumes intent everywhere.
Naivety assumes intent nowhere.

This text assumes incentives.

X. Preparedness

Preparedness means:

A good threat model is boring.

That is its success.

XI. Final Statement

Power does not need to be evil to become dangerous. Misalignment is enough.

This book asks for understanding, not fear.

Preparedness beats paranoia.