Threat model

A threat model states what is being protected, which adversarial actions are considered, which assumptions are trusted and which security properties must hold. A trust boundary marks where data or authority crosses between differently trusted parts. The model guides design and evaluation rather than treating every possible failure as equally relevant.^[ref]

For example, encrypting a database backup protects its contents from someone who obtains only the stored backup. That mechanism does not by itself stop a logged-in administrator from replacing live records, or an endpoint from disclosing data after decryption. Adding those capabilities to the attacker changes the model and may require authorization checks, integrity protection and audit evidence. An explicit model makes the scope of a security claim inspectable.