Threat Models: Know Who You Are Defending Against

Every earlier level taught you a mechanism. This one teaches the discipline that decides whether any of those mechanisms was worth buying: threat modeling. The question is never is this protection strong. It is strong against whom, doing what, for how long, at what cost. Vendors who skip that question are selling adjectives.

Name your attacker

Real attackers against shipped scripts and applications fall into rough tiers, and the difference between them is not talent, it is what they are willing to spend.

• Tier 1, the casual copier: wants your product free, will open the file, poke for five minutes, and give up or move on. Defeated by almost any obfuscation at all.
• Tier 2, the skilled hobbyist: comfortable with the language, knows the common tools and tricks of their scene, willing to spend evenings on a target that seems worth it. This is the default adversary for most commercial scripts.
• Tier 3, the professional: reverse engineering is their trade. Custom tooling, debuggers, instrumented sandboxes, and the patience to unpick a virtualized build. Time, not ability, is their only constraint.

Be honest about which tier your product actually attracts. A ten dollar utility script does not draw Tier 3 attention, because the prize cannot repay the hours. A popular product with a resale market absolutely does. Your threat model should scale with what an attacker gains, not with your pride in the code.

Price the attack, not the defense

A defense's job is to make an attack cost more than the attacker stands to gain. That framing makes evaluation concrete: for each attack step you learned in Level 5, ask what it costs your named attacker, in hours, against your protected output.

• Reading statically: minutes against clean code, days against well-layered transforms, longer still against a virtualized core.
• Running and dumping: bounded by how observable your secrets are at runtime, and this ceiling never disappears, as Level 5 taught.
• Rebuilding and reselling: the attack that actually costs you money requires understanding deep enough to modify and maintain, which is a far higher bar than extracting one string.

The metric that matters: the cost of the second break

Here is the sharpest single idea in this lesson. Suppose your attacker succeeds, fully, against one protected output. What did that victory buy them against your next build? If every output shares the same structure, the answer is everything: they write a script, and every future build falls for free. The attack cost is paid once and amortized across your whole catalog.

If instead every build differs in the details that their attack depended on, the victory buys them almost nothing. They pay close to full price, in skilled human hours, every single time. No sane attacker stays in that trade for a commodity product.

Judge any protection scheme by one ratio: the cost of attacking the second output divided by the cost of attacking the first. A scheme scoring near zero is a product-wide skeleton key waiting to be cut. A scheme scoring near one is doing its job, whatever its other properties.

This ratio is why per-build variance beats raw per-build strength in practice, and why the strongest-looking wall can be the weakest investment. A fixed, elaborate scheme invites exactly one well-funded effort followed by infinite free replays, the same economics that break DRM systems. Variance converts a capital expense for the attacker into an unavoidable operating expense, and operating expenses kill margins in piracy just as surely as in any other business.

A second expert-level habit: evaluate defenses against a specific attack step, not in the abstract. Anti-debugging does nothing against a static reader. String encryption does nothing against a memory dump. Neither observation makes those layers useless, it makes them components with defined jobs. A stack of defenses is coherent only when every attack step in your model has at least one layer whose job is to make that step expensive.

The ceiling every threat model has to price in

Before you rate any defense, replay the attack it must survive. The demonstration below walks the run-and-dump step from Level 5 against a string-encoded sample: statically clean, then fully readable the instant the code runs. Keep it in mind for the whole rest of this level. It is the fixed cost that no stack of layers ever reduces to zero, and a threat model that pretends otherwise is fiction.

The honest synthesis

Perfect protection does not exist, and this academy has told you exactly why at every step: shipped code can be read, and running code can be observed. What exists is engineering: raising each attack step's cost above your named attacker's budget, and denying amortization so no victory is ever wholesale. That is a real, buildable, verifiable defense. Anyone who promises more than that is asking you not to have taken this course.

Frequently asked questions