Human-Centered Threat Modeling in Practice: Lessons, Challenges, and Paths Forward

2025-11-15

AI Summary

This study addresses the practice logic and researcher agency in Human-Centered Threat Modeling (HCTM). Drawing on 23 in-depth interviews and employing qualitative analysis, it integrates perspectives from human-computer interaction, privacy research, and socio-technical systems theory to demonstrate that HCTM is not a standardized process but a value-laden practice dynamically shaped by participant relationships, disciplinary backgrounds, and institutional structures. The study innovatively proposes a values-oriented framework centered on care, justice, and autonomy, systematically identifying researchers’ emotional labor, ethical tensions, and structural constraints. Its contributions are threefold: (1) reconceptualizing HCTM as a participatory value negotiation process; (2) proposing three actionable pathways—co-developed infrastructure, recognition of diverse contributions, and policy-design co-translation; and (3) advancing security research toward greater inclusivity and accountability.

Technology Category

• Humans and AI: Learning Human Values and Preferences
• Application Domains: Humanities & Computational Social Science
• Cognitive Modeling & Cognitive Systems: Simulating Human Behavior

Application Category

• User Modeling, Personalization and Recommendation: Accountability, Transparency, and Ethics for personalization
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Security and Privacy: Data transparency and provenance

Abstract

Human-centered threat modeling (HCTM) is an emerging area within security and privacy research that focuses on how people define and navigate threats in various social, cultural, and technological contexts. While researchers increasingly approach threat modeling from a human-centered perspective, little is known about how they prepare for and engage with HCTM in practice. In this work, we conduct 23 semi-structured interviews with researchers to examine the state of HCTM, including how researchers design studies, elicit threats, and navigate values, constraints, and long-term goals. We find that HCTM is not a prescriptive process but a set of evolving practices shaped by relationships with participants, disciplinary backgrounds, and institutional structures. Researchers approach threat modeling through sustained groundwork and participant-centered inquiry, guided by values such as care, justice, and autonomy. They also face challenges including emotional strain, ethical dilemmas, and structural barriers that complicate efforts to translate findings into real-world impact. We conclude by identifying opportunities to advance HCTM through shared infrastructure, broader recognition of diverse contributions, and stronger mechanisms for translating findings into policy, design, and societal change.

Problem

• Examining how researchers implement human-centered threat modeling practices in real-world settings
• Identifying challenges like emotional strain and structural barriers in threat modeling research
• Exploring ways to translate human-centered threat findings into policy and societal impact

Innovation

• Conducting semi-structured interviews with researchers
• Examining study design and threat elicitation practices
• Focusing on participant-centered inquiry and values