Before you can ask what could go wrong, you have to agree on what you're protecting. In security, those things are called assets. Naming them is the first step of almost every threat modeling method, and it's the one teams most often skip, which is why so many threat models end up as long, flat lists where a missing log rotation sits next to a database anyone can read.
What counts as an asset
An asset is anything of value that an attacker could steal, change, destroy or misuse. It helps to think in five groups:
- Data: customer records, personal data, payment details, health records, intellectual property, source code, logs.
- Credentials and keys: passwords, session tokens, API keys, cloud access keys, TLS private keys, code-signing keys.
- Systems: production servers, databases, the admin console, the CI/CD pipeline, employee laptops, DNS.
- Capabilities: the ability to take payments, send email from your domain, deploy code or approve a transfer.
- Intangibles: reputation, customer trust, regulatory standing, availability during a peak period.
The last two groups are the ones people forget. An attacker who can send email from your domain may never touch your data, but the phishing they send in your name damages you all the same.
Target assets and stepping-stone assets
Some assets are valuable in themselves: the customer database is what an attacker ultimately wants. Others matter because of what they unlock. A cloud access key, a support agent's account or the build pipeline are rarely the goal. They're the route to the goal.
Both belong on the list, but they play different roles. Target assets become the goals at the top of your attack trees. Stepping-stone assets show up as the steps underneath them, and protecting them well often closes several attack paths at once.
How to identify assets in practice
You don't need an inventory tool. For a single system, a 20-minute conversation with three questions is enough:
- What would make the news? The breach that would make customers leave is your top target asset.
- What would we restore first? After a ransomware attack, which system has to be back first? That tells you what matters most for availability.
- What does an attacker need on the way? List the credentials, keys and privileged accounts that reach the assets above.
Then rank them. For each asset, note which part of the CIA triad matters most and roughly what a failure would cost. Five to ten ranked assets is plenty for one system.
Worked example: Invoicely
The Invoicely threat model listed five assets before drawing a single box:
| Asset | Type | Most important property |
|---|---|---|
| Invoices and customer records | Target | Confidentiality |
| Invoice PDFs | Target | Confidentiality |
| Payment status | Target | Integrity |
| User accounts and sessions | Stepping stone | Confidentiality and integrity |
| Availability at month end | Capability | Availability |
That short list decided the most important attack tree ("read another customer's invoices") before anyone opened the diagram editor.
Assets in risk management and compliance
Asset management is also a formal requirement in most security frameworks. ISO/IEC 27001:2022 Annex A includes controls for an inventory of information and other associated assets (5.9) and for classifying information (5.12). NIST's Cybersecurity Framework 2.0 starts its Identify function with asset management.
The compliance inventory and the threat model asset list serve different purposes. The inventory is complete and includes every laptop. The threat model list is short and ranked, and exists to focus a design discussion. Use the inventory to make sure you haven't forgotten something; don't paste it into the threat model.
Common mistakes
- Listing components instead of assets. "PostgreSQL" is a component. "Customer invoices stored in PostgreSQL" is an asset, and it tells you why the database matters.
- Forgetting the stepping stones. Many real breaches start with a leaked key or a compromised support account, not a direct attack on the database.
- Not ranking. An unranked list of twenty assets gives the session no focus. Agree on the top three.
Key takeaways
- An asset is anything an attacker could steal, change, destroy or misuse: data, systems, accounts, capabilities and reputation.
- Name assets before threats. Without a short, ranked asset list, a threat model treats every component as equally important.
- Rank each asset by which part of the CIA triad matters most, and by what a failure would cost the business.
- Some assets are stepping stones rather than targets: credentials, signing keys and admin consoles matter because of what they unlock.
Frequently asked questions
What is an example of an asset in cybersecurity?
Customer personal data, payment records, source code, cloud API keys, an administrator account, a domain name, a build pipeline and a company's reputation are all assets. Anything whose loss, exposure or corruption would hurt the organisation counts.
What is the difference between an asset and a resource?
In everyday IT the words overlap. In security, an asset is defined by its value to the organisation and to an attacker, not by being a piece of infrastructure. A server with nothing on it may matter little; a single API key can be a critical asset.
What are crown jewels in cybersecurity?
The small set of assets whose compromise would do the most damage, such as the customer database, payment systems or signing keys. Identifying them lets a team spend most of its security effort where it matters.
How many assets should a threat model list?
Usually five to ten for one system. The goal is a ranked shortlist that guides the rest of the session, not a complete inventory of every server and table.