How to Use Threat Modelling to Reduce Your Cybersecurity Risk

Tanya Wetson-Catt • 20 July 2023

As cyber threats continue to increase, businesses must take proactive steps. They need to protect their sensitive data and assets from cybercriminals. Threats to data security are persistent and they come from many different places. 


Today’s offices are digitally sophisticated. Just about every activity relies on some type of technology and data sharing. Hackers can breach these systems from several entry points. This includes computers, smartphones, cloud applications, and network infrastructure.


It’s estimated that cybercriminals can penetrate 93% of company networks.


One approach that can help organizations fight these intrusions is threat modelling.


Threat modelling is a process used in cybersecurity. It involves identifying potential threats and vulnerabilities to an organization's assets and systems.


Threat modelling helps businesses prioritize their risk management and mitigation strategies. The goal is to mitigate the risk of falling victim to a costly cyber incident.


Here are the steps businesses can follow to conduct a threat model.


Identify Assets That Need Protection


The first step is to identify assets that are most critical to the business. This includes sensitive data, intellectual property, or financial information. What is it that cybercriminals will be going after?


Don’t forget to include phishing-related assets. Such as company email accounts. Business email compromise is a fast-growing attack. It capitalizes on breached company email logins.


Identify Potential Threats


The next step is to identify potential threats to these assets. Some common threats could be cyber-attacks such as phishing. Others would be ransomware, malware, or social engineering.


Another category of threats could be physical breaches or insider threats. This is where employees or vendors have access to sensitive information.


Remember, threats aren’t always malicious. Human error causes approximately 88% of data breaches. So, ensure you’re aware of mistake-related threats, such as:


  • The use of weak passwords
  • Unclear cloud use policies
  • Lack of employee training
  • Poor or non-existent BYOD policies


Assess Likelihood and Impact


Once you've identified potential threats, take the next step. This is to assess the likelihood and impact of these threats. Businesses must understand how likely each threat is to occur. As well as the potential impact on their operations, reputation, and financial stability. This will help rank the risk management and mitigation strategies.

Base the threat likelihood on current cybersecurity statistics. As well as a thorough vulnerability assessment. It's best this assessment is by a trusted 3rd party IT service provider. If you’re doing your assessment with only internal input, you’re bound to miss something.


Prioritize Risk Management Strategies


Prioritize risk management strategies next. Base this on the likelihood and impact of each potential threat. Most businesses can’t tackle everything at once due to time and cost constraints. So, it’s important to rank solutions based on the biggest impact on cybersecurity.


Some common strategies to consider include implementing:


  • Access controls
  • Firewalls
  • Intrusion detection systems
  • Employee training and awareness programs
  • Endpoint device management


Businesses must also determine which strategies are most cost-effective. They should also align with their business goals.


Continuously Review and Update the Model


Threat modelling is not a one-time process. Cyber threats are constantly evolving. Businesses must continuously review and update their threat models. This will help ensure that their security measures are effective. As well as aligned with their business objectives.


Benefits of Threat Modelling for Businesses


Threat modelling is an essential process for businesses to reduce their cybersecurity risk. Identifying potential threats and vulnerabilities to their assets and systems is important. It helps them rank risk management strategies. As well as reduce the likelihood and impact of cyber incidents.


Here are just a few of the benefits of adding threat modelling to a cybersecurity strategy.


Improved Understanding of Threats and Vulnerabilities


Threat modelling can help businesses gain a better understanding of specific threats. It also uncovers vulnerabilities that could impact their assets. It identifies gaps in their security measures and helps uncover risk management strategies.


Ongoing threat modelling can also help companies stay out in front of new threats. Artificial intelligence is birthing new types of cyber threats every day. Companies that are complacent can fall victim to new attacks.


Cost-effective Risk Management


Addressing risk management based on the likelihood and impact of threats reduces costs. It can optimize company security investments. This will help ensure that businesses divide resources effectively and efficiently.


Business Alignment


Threat modelling can help ensure that security measures align with the business objectives. This can reduce the potential impact of security measures on business operations. It also helps coordinate security, goals, and operations.


Reduced Risk of Cyber Incidents


By implementing targeted risk management strategies, businesses can reduce risk. This includes the likelihood and impact of cybersecurity incidents. This will help to protect their assets. It also reduces the negative consequences of a security breach.


Get Started with Comprehensive Threat Identification


Wondering how to get started with a threat assessment? Our experts can help you put in place a comprehensive threat modelling program. Give us a call today to schedule a discussion.

Let's Talk Tech

More from our blog

The Smarter Way to Vet Your SaaS Integrations

by Tanya Wetson-Catt • 30 January 2026
Your business runs on a SaaS (software-as-a-service) application stack, and you learn about a new SaaS tool that promises to boost productivity and streamline one of your most tedious processes. The temptation is to sign up for the service, click “install,” and figure out the rest later. This approach sounds convenient, but it also exposes you to significant risk. Each new integration acts as a bridge between different systems, or between your data and third-party systems. This bridging raises data security and privacy concerns, meaning you need to learn how to vet new SaaS integrations with the seriousness they require. Protecting Your Business from Third-Party Risk A weak link can lead to compliance failures or, even worse, catastrophic data breaches. Adopting a rigorous, repeatable vetting process transforms potential liability into secure guarantees. If you’re not convinced, just look at the T-Mobile data breach of 2023 . While the initial vector was a zero-day vulnerability in their environment, a key challenge in the fallout was the sheer number of third-party vendors and systems T-Mobile relied upon. In highly interconnected systems, a vulnerability in one area can be exploited to gain access to other systems, including those managed by third parties. The incident highlighted how a sprawling digital ecosystem multiplies the attack surface. By contrast, a structured vetting process, which maps the tool’s data flow, enforces the principle of least privilege , and ensures vendors provide a SOC 2 Type II report, drastically minimises this attack surface. A proactive vetting strategy ensures you are not just securing your systems, but you are also fulfilling your legal and regulatory obligations, thereby safeguarding your company’s reputation and financial health. 5 Steps for Vetting Your SaaS Integrations To prevent these weak links, let’s look at some smart and systematic SaaS vendor/product evaluation processes that protect your business from third-party risk. 1. Scrutinise the SaaS Vendor’s Security Posture After being enticed by the SaaS product features, it is important to investigate the people behind the service. A nice interface means nothing without having a solid security foundation. Your first steps should be examining the vendor’s certifications and, in particular, asking them about the SOC 2 Type II report . This is an independent audit report that verifies the effectiveness of a retail SaaS vendor’s controls over the confidentiality, integrity, availability, security, and privacy of their systems. Additionally, do a background check on the founders, the vendor’s breach history, how long they have been around, and their transparency policies. A reputable company will be open about its security practices and will also reveal how it handles vulnerability or breach disclosures. This initial background check is the most important step in your vetting since it separates serious vendors from risky ones. 2. Chart the Tool’s Data Access and Flow You need to understand exactly what data the SaaS integration will touch, and you can achieve this by asking a simple, direct question: What access permissions does this app require? Be wary of any tool that requests global “read and write” access to your entire environment. Use the principle of least privilege: grant applications only the access necessary to complete their tasks, and nothing more. Have your IT team chart the information flow in a diagram to track where your data goes, where it is stored, and how it is transmitted. You must know its journey from start to finish. A reputable vendor will encrypt data both at rest and in transit and provide transparency on where your data is stored, including the geographical location. This exercise in third-party risk management reveals the full scope of the SaaS integration’s reach into your systems. 3. Examine Their Compliance and Legal Agreements If your company must comply with regulations such as GDPR , then your vendors must also be compliant. Carefully review their terms of service and privacy policies for language that specifies their role as a data processor versus a data controller, and confirm that they will sign a Data Processing Addendum (DPA) if required. Pay particular attention to where your vendor stores your data at rest, i.e., the location of their data centres, since your data may be subject to data sovereignty regulations that you are unaware of. Ensure that your vendor does not store your data in countries or regions with lax privacy laws. While reviewing legal fine print may seem tedious, it is critical, as it determines liability and responsibility if something goes wrong. 4. Analyse the SaaS Integration’s Authentication Techniques How the service connects with your system is also a key factor. Choose integrations that use modern and secure authentication protocols such as OAuth 2.0 , which allow services to connect without directly sharing usernames and passwords. The provider should also offer administrator dashboards that enable IT teams to grant or revoke access instantly. Avoid services that require you to share login credentials, and instead prioritise strong, standards-based authentication. 5. Plan for the End of the Partnership Every technology integration follows a lifecycle and will eventually be deprecated, upgraded, or replaced. Before installing, know how to uninstall it cleanly by asking questions such as: What is the data export process after the contract ends? Will the data be available in a standard format for future use? How does the vendor ensure permanent deletion of all your information from their servers? A responsible vendor will have clear, well-documented offboarding procedures. This forward-thinking strategy prevents data orphanage, ensuring you retain control over your data long after the partnership ends. Planning for the exit demonstrates strategic IT management and a mature vendor assessment process. Build a Fortified Digital Ecosystem Modern businesses run on complex systems comprising webs of interconnected services where data moves from in-house systems, through the Internet, and into third-party systems and servers for processing, and vice versa. Since you cannot operate in isolation, vetting is essential to avoid connecting blindly. Your best bet for safe integration and minimising the attack surface is to develop a rigorous, repeatable process for vetting SaaS integrations. The five tips above provide a solid baseline, transforming potential liability into secure guarantees.  Protect your business and gain confidence in every SaaS integration, contact us today to secure your technology stack.

5 Ways to Implement Secure IT Asset Disposition (ITAD) in Your Small Business

by Tanya Wetson-Catt • 26 January 2026
Even the most powerful IT hardware today will eventually become outdated or faulty and will need to be retired. However, these retired servers, laptops, and storage devices hold a secret: they contain highly sensitive data. Simply throwing them in the recycling bin or donating them without preparation is a compliance disaster and an open invitation for data breaches. This process is called IT Asset Disposition (ITAD). Simply put, ITAD is the secure, ethical, and fully documented way to retire your IT hardware. Below are five practical strategies to help you integrate ITAD into your technology lifecycle and protect your business. 1. Develop a Formal ITAD Policy You can’t protect what you don’t plan for. Start with a straightforward ITAD policy that clearly outlines the steps and responsibilities, no need for pages of technical jargon. At a minimum, it should cover: The process for retiring company-owned IT assets. Who does what; who initiates, approves, and handles each device. Standards for data destruction and final reporting. A clear policy keeps every ITAD process consistent and accountable through a defined chain of custody. It turns what could be a one-off task into a structured, secure routine, helping your business maintain a strong security posture all the way to the end of the technology lifecycle. 2. Integrate ITAD Into Your Employee Offboarding Process Many data leaks stem from unreturned company devices. When an employee leaves, it’s critical to recover every piece of issued equipment, laptops, smartphones, tablets, and storage drives included. Embedding ITAD into your offboarding checklist ensures this step is never overlooked. With this process in place, your IT team is automatically notified as soon as an employee resigns or is terminated, allowing you to protect company data before it leaves your organisation. Once a device is collected, it should be securely wiped using approved data sanitisation methods before being reassigned or retired. Devices that are still in good condition can be reissued to another employee, while outdated hardware should enter your ITAD process for proper disposal. This disciplined approach eliminates a common security gap and ensures sensitive company data never leaves your control. 3. Maintain a Strict Chain of Custody Every device follows a journey once it leaves an employee’s hands, but can you trace every step of that journey? To maintain full accountability, implement a clear chain of custody that records exactly who handled each asset and where it was stored at every stage. This eliminates blind spots where devices could be misplaced, tampered with, or lost. Your chain of custody can be as simple as a paper log or as advanced as a digital asset tracking system. Whichever method you choose, it should at minimum document key details such as dates, asset handlers, status updates, and storage locations. Maintaining this record not only secures your ITAD process but also creates a verifiable audit trail that demonstrates compliance and due diligence. 4. Prioritise Data Sanitisation Over Physical Destruction Many people think physical destruction, like shredding hard drives, is the only fool proof way to destroy data. In reality, that approach is often unnecessary for small businesses and can be damaging to the environment. A better option is data sanitisation, which uses specialised software to overwrite storage drives with random data, making the original information completely unrecoverable. This method not only protects your data but also allows devices and components to be safely refurbished and reused. Reusing and refurbishing your IT assets extends their lifespan and supports the principles of a circular economy, where products and materials stay in use for as long as possible to reduce waste and preserve natural resources. With this approach, you’re not just disposing of equipment securely; you’re also shrinking your environmental footprint and potentially earning extra revenue from refurbished hardware. 5. Partner With a Certified ITAD Provider Many small businesses don’t have the specialised tools or software required for secure data destruction and sanitisation. That’s why partnering with a certified ITAD provider is often the smartest move. When evaluating potential partners, look for verifiable credentials and industry certifications that demonstrate their expertise and commitment to compliance. Some of the common globally accepted certifications to look for in ITAD vendors include e-Stewards and the R2v3 Standard for electronics reuse and recycling, and NAID AAA for data destruction processes. These certifications confirm that the vendor adheres to strict environmental, security, and data destruction standards, while taking on full liability for your retired assets. After the ITAD process is complete, the provider should issue a certificate of disposal, whether for recycling, destruction, or reuse, which you can keep on file to demonstrate compliance during audits. Turn Old Tech into a Security Advantage Your retired IT assets aren’t just clutter; they’re a hidden liability until you manage their disposal properly. A structured IT Asset Disposition program turns that risk into proof of your company’s integrity and commitment to data security, sustainability, and compliance. Take the first step toward secure, responsible IT asset management, contact us today.

How to Use Conditional Access to Grant and Revoke Contractor Access in 60 Minutes

by Tanya Wetson-Catt • 19 January 2026
Managing contractor logins can be a real headache. You need to grant access quickly so work can begin, but that often means sharing passwords or creating accounts that never get deleted. It’s the classic trade-off between security and convenience, and security usually loses. What if you could change that? Imagine granting access with precision and having it revoked automatically, all while making your job easier. You can, and it doesn’t take a week to set up. We’ll show you how to use Entra Conditional Access to create a self-cleaning system for contractor access in roughly sixty minutes. It’s about working smarter, not harder, and finally closing that security gap for good. The Financial and Compliance Case for Automated Revocation Implementing automated access revocation for contractors is not just about better security; it's a critical component of financial risk management and regulatory compliance. The biggest risk in contractor management is relying on human memory to manually delete accounts and revoke permissions after a project ends. Forgotten accounts with lingering access, often referred to as “dormant” or “ghost” accounts, are a prime target for cyber-attackers. If an attacker compromises a dormant account, they can operate inside your network without detection, as no one is monitoring an "inactive" user. For example, many security reports cite the Target data breach in 2013 as a stark illustration. Attackers gained initial entry into Target's network by compromising the credentials of a third-party HVAC contractor that had legitimate, yet overly permissive, access to the network for billing purposes. If Target had enforced the principle of least privilege, limiting the vendor's access only to the necessary billing system, the lateral movement that compromised millions of customer records could have been contained or prevented entirely. By leveraging Microsoft Entra Conditional Access to set a sign-in frequency and instantly revoke access when a contractor is removed from the security group, you eliminate the chance of lingering permissions. This automation ensures that you are consistently applying the principle of least privilege, significantly reducing your attack surface and demonstrating due diligence for auditors under regulations like GDPR or HIPAA. It turns a high-risk, manual task into a reliable, self-managing system. Set Up a Security Group for Contractors The first step to taming the chaos is organisation. Applying rules individually is a recipe for forgotten accounts and a major security risk. Instead, go to your Microsoft Entra admin center (formerly Azure AD admin center) and create a new security group with a clear, descriptive name, something like 'External-Contractors' or 'Temporary-Access'. This group becomes your central control point. Add each new contractor to it when they start, and remove them when their project ends. This single step lays the foundation for clean, scalable management in Entra. Build Your Set-and-Forget Expiration Policy Next, set up the policy that automatically handles access revocation for you. Conditional Access does the heavy lifting so you don’t have to. In the Entra portal, create a new Conditional Access policy and assign it to your “External-Contractors” group. Then, define the conditions that determine how and when access is granted or removed. In the “Grant” section, enforce Multi-Factor Authentication to add an essential layer of security. Next, under “Session,” locate the “Sign-in frequency” setting and set it to 90 days, or whatever duration matches your contracts. This not only prompts regular logins but ensures that once a contractor is removed from the group, they can no longer re-authenticate, automatically locking the door behind them. Lock Down Access to Just the Tools They Need Think about what a contractor actually does. A freelance writer needs access to your content management system, but probably not your financial software. A web developer needs to reach staging servers, but has no business in your HR platform. Your next policy ensures they only get the keys to the rooms they need. Next, create a second Conditional Access policy for your contractor group. Under “Cloud apps,” select only the applications they are permitted to use, such as Slack, Teams, Microsoft Office, or a specific SharePoint site. Then, set the control to “Block” for all other apps. Think of this as building a custom firewall around each user. It’s a powerful way to reduce risk, applying the principle of least privilege: give users access only to the tools and permissions they need to do their job, and nothing more. Add an Extra Layer of Security with Strong Authentication For an even more robust setup, you can layer in device and authentication requirements. You are not going to manage a contractor’s personal laptop, and that is okay. However, it is your business and systems they will be using, and this means that you get to control how they prove their identity. The goal is to make it very difficult for an attacker to misuse their credentials. You can configure a policy that requires a compliant device, then use the “OR” function to allow access if the user signs in with a phishing-resistant method, such as the Microsoft Authenticator app. This encourages contractors to adopt your strongest authentication method without creating friction, while fully leveraging the security capabilities of Microsoft Entra. Watch the System Work for You Automatically The greatest benefit is that once configured, contractor access becomes largely automatic. When a new contractor joins the security group, they instantly receive the access you’ve defined, complete with all security controls. When their project ends and you remove them from the group, access is revoked immediately and completely, including any active sessions, eliminating any chance of lingering permissions. This automation removes the biggest risk, relying on someone to remember to act. It turns a high-risk, manual task into a reliable, self-managing system, eliminating concerns about forgotten accounts and their security risks, so you can focus on the business work that really matters. Take Back Control of Your Cloud Security Managing contractor access doesn’t have to be stressful. With a little upfront setup in Conditional Access policies, you can create a system that’s both highly secure and effortlessly automatic. Grant precise access for a defined period, and enjoy the peace of mind that comes from knowing access is revoked automatically. It’s a win for security, productivity, and your peace of mind.  Take control of contractor access today, contact us to build your own set-and-forget access system.