Threat modelling sounds like something reserved for security teams with diagrams and workshops. For personal email it can be a single page. The goal is to answer four questions: what do I need to protect, from whom, how would they try to get it, and what am I going to do about it? Writing the answers down is most of the value. It stops you spending effort on a risk you do not have and ignoring one you do.
Step one: list the assets
Start with what the mailbox actually holds, not what you think it holds. Common assets include:
- Access to other accounts, through password reset and recovery messages
- Financial and identity documents, including statements, tax records and scans
- Private correspondence with family, friends, medical providers or lawyers
- Work material you are allowed to keep in personal mail, if any
- Your contacts list and the record of who you write to and when
Rank them roughly. Account recovery is usually the highest, because it unlocks everything else.
Step two: name the adversaries
Different people threaten different mailboxes. Be specific about the ones you consider realistic:
- Opportunistic criminals send mass phishing, reuse leaked passwords and buy stolen credentials. They target volume, not you in particular.
- Someone you know may have physical access to a device, know your password habits, or have a grievance. This is often the most damaging category for personal mail.
- Network observers on a shared network, or at an internet provider, can see metadata and attempt interception on weak connections.
- The provider and its staff
- Well-resourced attackers may target you for a specific reason. Be honest about whether you are likely to be one.
Step three: map the likely attacks
For each asset and adversary, write down the most plausible route. This is the step that turns a vague worry into something you can act on. An example, using a generic personal mailbox:
| Asset | Adversary | Likely attack | Control | Residual risk |
|---|---|---|---|---|
| Recovery access | Opportunistic criminal | Password reuse from a breach, then phishing for a code | Unique password, TOTP or FIDO2 second factor | Phishing that captures a one-time code |
| Tax and identity scans | Someone with device access | Opening the unlocked laptop or phone | Screen lock, full-disk encryption, attachment cleanup | Unlocked session left open |
| Private correspondence | Network observer | Interception on public Wi-Fi | TLS-only connections, avoid unknown networks | Metadata still visible at the network level |
| Message contents on the server | Provider staff or legal request | Access to stored mail | Encryption at rest, minimal retention, PGP for sensitive threads | Non-PGP mail is readable by the provider |
| Contact graph | Any party with account access | Reading the sent and received history | Limit what you keep, review session access | History exists while the mailbox does |
Step four: choose controls that match the risk
Good controls are specific and cheap relative to the harm they prevent. For most individuals the first set is:
- A unique password for the mailbox, stored in a password manager.
- A second factor. TOTP is widely supported. FIDO2 security keys resist phishing better, because the key checks the site it is talking to. ITProMail supports both.
- App passwords for each mail client, so a lost device can be revoked without changing your login password.
- Regular review of active sessions under Account > Security, and sign-out on shared computers.
- Recovery options that you control, and recovery codes stored offline.
Encryption deserves an honest description. TLS protects mail in transit between your client and the server, and between servers. Encryption at rest protects stored mail against someone who takes the disks but not the keys. Neither stops the provider, or anyone with your account credentials, from reading mail. Only end-to-end encryption, such as OpenPGP with keys you hold, does that, and it covers only the messages that use it. The PGP documentation and PGP in practice explain when it is worth the effort.
Step five: decide what you accept
Some risks will remain. Write them down with a reason. For example: "I accept that the provider can read non-PGP mail, because the content is ordinary correspondence." That sentence is more useful than a vague intention to be more secure. Revisit the model when something changes: a new job, a move, a breach at a service you use, or a new device.
Keep it short
A threat model that fits on one page and gets reviewed twice a year is more useful than an elaborate one that is never updated. The output should be a short list of controls you have actually put in place, and a short list of risks you have decided to live with.
For the practical checklist that goes with this model, see the security checklist. For phishing, which is the most likely route into most personal mailboxes, read spotting modern phishing.