SUMMARY: A threat sketch is a fast, plain-language model of what could go wrong and how the operator would recognize it.
Not every risk needs a full report before it can be handled. Some risks need a sketch: the asset, the actor, the path, the harm, the evidence, and the first response. The sketch keeps the operator from waiting for perfect certainty before naming a pattern.
A good sketch is short enough to update and specific enough to test.
Sketch Fields
Asset: the page, account, conversation, route, file, or audience that needs protection.
Path: the likely way pressure reaches that asset.
Harm: the practical damage if the path succeeds.
Evidence: the log, content change, user report, endpoint behavior, or search signal that would confirm concern.
First response: the least disruptive action that reduces exposure while preserving review.
Where to Use It
Use threat sketches with review deltas. The delta shows what changed. The sketch decides whether the change represents pressure, noise, or ordinary motion.
Operator Rule
Name the risk in language the next operator can act on.
Field assessment: the sketch is not the verdict; it is the first useful shape of concern.
Move From a Threat Sketch to a Controlled Test
The sketch becomes useful when each assumption can be tested. If the path depends on reused credentials, review authentication records and recovery routes. If it depends on silent content changes, compare revisions and checksums. If it depends on social pressure, preserve reports and moderation decisions. Evidence should confirm or weaken a named path, not merely create a larger pile of alarming material.
Threat Sketch Decision States
- Observe: evidence is incomplete and the current exposure is controlled.
- Contain: a reversible step can reduce exposure while facts are gathered.
- Escalate: impact or uncertainty exceeds the current operator’s authority.
- Close: the proposed path is unsupported, mitigated, or transferred to a formal review.
Record what would move the sketch from one state to another. Use the Review Delta to track changed evidence and the Recovery Packet when restoration steps must be ready. The Operator Lexicon places the sketch in context.
Threat Sketch Template
Write the sketch as a testable sequence rather than a list of fears: because this actor or condition can reach this asset through this path, this consequence may occur; these observations would confirm or weaken the model. That sentence keeps the threat, evidence, and decision connected.
- Name the protected asset and the service it supports.
- Describe the actor, pressure, or failure condition without assuming intent that evidence cannot establish.
- Trace the plausible path from entry point to consequence.
- List observations that would confirm, weaken, or close the sketch.
- Choose a reversible first response and the authority required for escalation.
- Set a review time so an unconfirmed sketch does not become permanent suspicion.
When the path crosses several systems, use a distributed correction test to verify that containment and reversal can reach every consequential copy.