Going Offline Doesn’t Make You Invisible: A Threat Model for the Non-Digital Principal

Threat modeling was born in software. You draw boxes and arrows, mark the trust boundaries, walk each flow against a mnemonic, and file the results as bugs. It works, it scales, and it has one blind spot the size of a person: nearly every published method models systems, and the subject we are asked about most often is not a system. It is a human being — a corporate principal with a position, a lifestyle, a standing in the community, and, in the case this article examines, no internet presence and no social media at all.

That last detail seduces people into thinking there is nothing to model. No accounts to hijack, no posts to scrape, no feed to poison. The person is invisible, and invisible means safe. That conclusion is wrong, and it is wrong in a way that matters: the offline principal still exists in public records, in the routines of a household, in the behavior of staff, and in the memory of a community. What the offline choice actually does is migrate the exposure — from the principal's own hands to everyone and everything around them. A threat model that ignores this migration does not protect anyone. It just documents the wrong surface.

This piece is for security practitioners who need to model a person the way they would model an architecture: systematically, with named assets, named adversaries, explicit boundaries, and reviewed outputs. The frameworks transfer. The objects being modeled change completely.

Foundations: What Threat Modeling Actually Is

Strip away the tooling and threat modeling answers four questions. Adam Shostack's Four Question Framework is the cleanest statement of them:

1. What are we working on? Build a model of the subject — deliberately simplified, so the whole is visible at once.
2. What can go wrong? Enumerate threats against that model, from an attacker's point of view.
3. What are we going to do about it? Mitigate, eliminate, transfer, or accept each threat. Ignore is not on the list.
4. Did we do a good job? Check the model against reality, review each threat, and verify that the chosen response works.

Everything else — STRIDE, PASTA, OCTAVE, LINDDUN, attack trees, Persona non Grata — is machinery for answering those questions faster and more repeatably. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is a checklist of what can go wrong at a boundary. PASTA is a seven-stage, risk-centric walk from business objectives to simulated attacks. OCTAVE builds asset-based threat profiles at the organizational level. Attack trees decompose an attacker's goal into steps and are the right tool when you want to reason about attacker economics. Persona non Grata models archetypal malicious actors — insiders, opportunists, ideologues — and forces the analyst to see the system from the misuse side.

Two structural facts from the software world carry over unchanged. First, threats follow data; whatever carries value carries risk. Second, every trust boundary crossing is a candidate threat. In a human threat model the data is information about the person, and the trust boundaries are the lines between the private life, the household, the workplace, the community, and the public record. Cross those lines and you generate exposure, whether the crossing is a property filing, a spouse's photograph, or a driver's LinkedIn profile.

One more foundation matters more here than it does in software: security only works if the humans involved will actually use it. Saltzer and Schroeder knew this in 1975 — a mechanism must be psychologically acceptable to the people who must apply it — and Kerckhoffs said it a century earlier: a secure system must not require "stress of mind." An offline principal is, almost by definition, a person who has rejected tools that demanded too much. Any model that ends in a stack of apps and rituals the subject will abandon by month two is a failed model. Human-first subject, human-usable controls. Keep that constraint in view from the first line of the diagram.

What Are We Working On? Modeling a Life Instead of an Architecture

The "system" is a life. Model it in domains, the way you would decompose a service architecture:

Then draw the flows: who knows what, who talks to whom, which records tie which names together. The model does not need to be a polished diagram. Two weeks of documented observation — where the subject goes, who accompanies them, what the household publishes, what the public record already confirms — produces a better model than a month of speculation. Principals are invariably surprised by the result. That surprise is the assessment working.

The assets worth protecting in a human model are not files. They are: physical safety (the subject and the family), autonomy of movement, reputation and standing, decision-making authority and the information behind it, financial position, and relationships. Note that social status cuts both ways — it is an asset to protect and the amplifier that makes every other asset worth attacking. A community leader is targeted more often, observed more often, and talked about more often. Status raises the expected return for an adversary, which raises likelihood, while visibility raises exposure, which raises likelihood again. The two multiply.

The Offline Paradox: Where the Exposure Actually Lives

Now the core finding. For a principal with no accounts and no posts, the effective digital footprint is assembled entirely from proxies, and it is assembled whether the principal consents or not:

Public records. Property deeds, voter registrations, business licenses, corporate appointments, court filings, campaign contributions. A single filing can tie a name to an address; a second ties the family. Research published in 2026 found roughly 94% of executives had a home address publicly linked to their name through records or people-search sites — and none of that requires the subject to have ever touched a keyboard. Offline principals are more dependent on this layer, not less, because they cannot crowd it out with controlled content.

The inner circle. Spouses, adult children, executive assistants, drivers, household staff, vendors. Studies of executive exposure repeatedly find the family is the softer target: family members average six to eight public social media accounts each, and the overwhelming majority of those accounts leak details about the principal. A partner's charity-board listing confirms residence and standing. A child's sports schedule confirms a Saturday window. An assistant's professional profile confirms the principal's name, title, office, and often commute radius. For an offline subject, these people are the online presence.

Pattern of life. Same gym, same parking spot, same Thursday dinner, same flight to the same quarterly meeting. Routine is efficiency, and efficiency looks like a schedule to anyone patient enough to watch. Physical observation of routine requires no technical skill at all.

Community visibility. Church, clubs, school events, charity galas, the reserved table, the distinctive car in the reserved spot. The social status that defines the principal's position guarantees recognition, and recognition guarantees that location knowledge propagates through conversation alone.

Commercial data. Data brokers aggregate everything above and sell the bundle. Removal services help, but they do not erase public records — property and business filings remain.

The practitioner's takeaway: run the exposure assessment on the household and staff graph, not on the principal alone. Map the social graph first — who is one hop away, what each hop publishes, which public record ties the names together — and only then decide what "offline" bought you. What it bought is real but narrow: no direct account takeover, no self-authored geolocation, no scraped feed. What it did not buy is anonymity, and it shifted the weight of the model onto people who never agreed to be in it.

What Can Go Wrong? Adversaries, Not Just Threats

Enumerate adversaries before enumerating attacks; capability and motivation determine which threats are worth modeling. A useful tiering for a high-status human:

Against that cast, the threat categories that recur for an offline high-status human are:

• Physical harm or abduction, planned from routine and residence knowledge.
• Fraud and impersonation — someone posing as the principal or preying on staff with enough confirmed detail to be convincing. Compromising an assistant's calendar access achieves more than most technical intrusions.
• Doxxing and harassment of the principal or family, including targeted campaigns seeded with genuine details.
• Extortion or coercion built on surveillance, undisclosed relationships, or financial information.
• Insider exploitation: domestic staff, drivers, or corporate personnel with authorized access — the threat Persona non Grata exists to model, and the one most often dismissed until it materializes.
• Family-directed attacks: the softer entry point. A compromised family email account or a credentialed pretext against a spouse yields travel plans, financial authority, and the principal's state of mind.
• Reputation operations, including misinformation that escalates into physical risk — a convergence now reported by a majority of large organizations.

Attack trees earn their keep here. Pick the adversary's goal ("obtain the home address," "confirm the household is away on these dates") and decompose it: name → property filing; name → relative's account → tagged photo; address → data-broker profile → everyone associated with that address → back to the principal. Every leaf is a place to cut the branch.

Lifestyle and Status: The Attack Surface That Cannot Be Patched

Software has vulnerabilities; people have habits. The habit-level findings that show up in nearly every assessment of a high-status principal:

• Fixed anchors. Arrival and departure times that vary by minutes. One route in, one route out, through the same choke points.
• Published commitments. Board meetings, speaking slots, award dinners, kids' games — scheduled weeks ahead and known in the community regardless of whether they are ever posted online.
• Status signals. The car, the reserved spot, the house, the guest list. Signaling position is the function of much of this; no threat model eliminates it, and pretending otherwise burns credibility with the subject.
• Household leakage. The spouse's photo, the assistant's check-in, the driver's employment listing. Information aggregates; nobody in the household intends harm.
• Announcements of absence. Travel known in advance is the classic burglary and approach window — and for the offline principal, absence propagates by word of mouth and calendar, not by feed.

The correct framing for practitioners: predictability is the vulnerability, and it is managed, not eliminated. Variation breaks the confidence an observer needs more reliably than any countermeasure. Two or three routes instead of one. Departure windows instead of departure times. Late confirmation of public appearances. Photographs published after return, not during. These are behaviors, not products — which is exactly why they fit an offline principal better than another app ever will.

What Are We Going to Do? Responses Mapped to Human Reality

Shostack's four response types map cleanly onto personal security:

Layer the responses. Concentric rings — household discipline, residential security, movement discipline, staff vetting, protective intelligence, and only then overt protection — ensure that one failed layer buys time instead of buying the adversary an outcome. Note where the layers concentrate for an offline subject: the household and staff ring carries most of the weight, because that is where the migrated exposure lives. A short, respectful briefing of the inner circle — what not to share, how to handle pretext calls, whom to notify about unusual interest — outperforms most technology in this model. Vet domestic staff and drivers with the same rigor as corporate insiders, because in this system they are insiders.

Protective intelligence closes the loop: one reporting channel for gate incidents, unusual contacts, repeated faces, and messages; behavior and geographic movement matter more than hostile language; historical cases are retained so a returning figure is not treated as new. An online persona that progresses from posting → event appearance → near the office → near the residence has changed threat level without changing tone. For an offline principal, the equivalent signal is community-level: repeated questions to staff, unusual interest in routine, a stranger at the usual places.

Did We Do a Good Job? Making the Model a Cycle

A threat model of a person decays faster than one of an architecture, because lives change. Validate it the way you would validate any model:

1. Test the model against reality. Run a periodic OSINT exposure assessment against the principal and the household graph. If a competent outsider can still derive the home address or a weekly window in under an hour, the model has gaps the adversary will find first.
2. Review every threat. Each one is mitigated, eliminated, transferred, or accepted — with a named owner. "We should be careful about that" is not a response type.
3. Verify the controls work. A pretext call drill against the assistant, a check that vetting actually completed, a review of whether the route variation is actually happening. Controls that exist on paper only are accepted risks wearing a costume.
4. Re-model on life events. New role, new board seat, a public appearance, litigation, a relocation, a change in the household. Trigger the cycle again.

The fourth step is the one teams skip, and it is the one that matters most for a human subject. The system is alive.

The Practitioner's Checklist

For those who model people rather than software, the condensed workflow:

1. Define assets — safety, movement, standing, decision authority, financial position, relationships. Name them; "the principal" is not an asset list.
2. Map the system — the seven domains above, plus the social graph of everyone one hop away and the public records that tie the names together.
3. Enumerate adversaries by tier — opportunist through organizational — and model only the threats their capability supports. Persona non Grata archetypes work well for the insider and ideologue tiers.
4. Decompose with attack trees — adversary goals down to leaves; cut the cheapest branches first (broker removals, briefing the household, varying the routine).
5. Respond in layers — mitigate, eliminate, transfer, accept — biased toward behavior over gadgets, because behavior is what an offline principal will actually keep doing.
6. Review on a cycle and on triggers — periodic exposure assessments, one reporting channel, retained case history.

Closing

Threat modeling a human is not a metaphor borrowed from software. It is the same discipline applied to an older and messier system: a life, with its own data flows, its own trust boundaries, and its own attack surface. The offline principal makes the exercise sharper, not easier — every layer of digital self-defense the subject declines to use reappears as exposure distributed across family, staff, records, and routine. The practitioner's job is to model that distribution honestly, name who can reach what, and build defenses the subject will actually live with.

Model the person. Model the household around the person. Model what the public record already says. Then ask the four questions again in six months, because the only thing that changes faster than a threat landscape is a life.