Former CISO pitches four-question whiteboard threat modeling
Original title: Threat Modeling With 4 Simple Questions on a White Board
Lora Vaughn told an ISC2 congress in Denver a short exercise can guide spending without a long report.
At ISC2 Strategic Congress 2026 in Denver, former CISO Lora Vaughn said teams can start threat modeling with four whiteboard questions instead of a costly report. She said the exercise can apply from the NSA to small businesses and then shape investment choices. She called handing enterprise security to an agentic AI model a fantasy, after describing earlier hype around cloud, automation and zero trust.
Unconfirmed: The excerpt does not state what the four questions are.
- Vaughn now leads consulting firm The Vaughn Group.
- She presented the exercise at ISC2 Strategic Congress in Denver.
- The published excerpt does not list the four questions.
- Organizations
- ISC2The Vaughn Group
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0976de79337ac3812bd4e8604cb04c0d | er-ransomware-activity#recipe=similar-items&sourcecontentid=0976de79337ac3812bd4e8604cb04c0d) US Cyber Pros Plead Guilty Over BlackCat Ransomware Activ |
| md5 | 3de05debc69bdf840acf3ce3c6457ee8 | e-getting-more-violent#recipe=similar-items&sourcecontentid=3de05debc69bdf840acf3ce3c6457ee8) How Can CISOs Respond to Ransomware Getting More Violent? |
| md5 | 842bd5a84d1f4b7738c164d8542426b4 | mminent-threat-act-now#recipe=similar-items&sourcecontentid=842bd5a84d1f4b7738c164d8542426b4) Microsoft Exchange 'Under Imminent Threat,' Act Now by Ar |
| md5 | dd763fcf1c8714815d52f82a2a0d8a90 | cyber-strategy-changes#recipe=similar-items&sourcecontentid=dd763fcf1c8714815d52f82a2a0d8a90) Switching to Offense: US Makes Cyber Strategy Changes by |
From the original article
9 min read at darkreading.com
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.
By Becky Bracken · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.