LEGO® SERIOUS PLAY® and Threat Modeling

Meet Simone Onofri, from Italy and Spain. He is the Security Lead at the World Wide Web Consortium (W3C) and a certified LEGO® SERIOUS PLAY® facilitator since February 2015. Simone brings together technical precision and human-centred design to explore how collaborative play can strengthen the security of the web. Read his story about why he believes that building with LEGO® bricks can help build a safer digital world for everyone.

Why Threat Modeling Matters in Standardization

Threat Modeling is the process of defining a system model (the scope), identifying threats and their resulting attacks, addressing them with responses, and continuously revalidating. It is normally used during the design phase of software development, but “at W3C, threat modeling is not just about computer systems — it’s about humans”, Simone explains. 

As emphasized by the United Nations, which has asked various standards development organizations, such as the W3C, to integrate human rights into standardization, standards shape the foundations of digital technology: browsers, digital identity wallets, and the systems we all rely on daily. But as standards become the invisible infrastructure of societies, so do their threats. That is why, at W3C, we are developing a methodology to analyze technical threats alongside their harms, integrating them with harm frameworks.

Understanding harms —the negative impact of threats—from discrimination and exclusion to manipulation and loss of agency—becomes essential. 

“Security and privacy cannot be treated in isolation anymore. We need to bring together multidisciplinary and multi-stakeholder collaboration — from engineers and designers to ethicists and human-rights experts — to identify not only technical vulnerabilities but also social harms.” Bringing together people with diverse skills and goals is difficult.

Why LEGO® SERIOUS PLAY® Is Ideal for Threat Modeling

LEGO® SERIOUS PLAY® (LSP) method aligns perfectly with the principles of participatory and inclusive threat modeling. Instead of relying on abstract discussions or long documents, LSP lets participants build their reasoning physically, making abstract threats and harms visible and negotiable.

During the workshop “Threat Modeling with LEGO SERIOUS PLAY”, Simone guided participants through a hands-on exploration of digital identity harms. After the skill-building phase, participants then constructed models representing possible harms, transformed them into threat scenarios, and collaboratively arranged their builds into a shared “threat landscape”.

“Consensus doesn’t come from talking the loudest — it emerges when everyone’s model is on the table,” Simone reflects. “By seeing our harms side by side, we create a collective map of threats that no single expert could have drawn alone.”

The final “retrospective duck” invited everyone to build one insight they had learned — a tangible metaphor for how play can lead to structured awareness. What emerged was a space where security experts, privacy advocates, policy analysts, and human-rights researchers could find common ground and connect their ideas.

Beyond this specific application, LSP for Threat Modeling can also be used for enterprise software projects.

“LEGO® SERIOUS PLAY® transforms threat modeling into a dialogue,” Simone concludes. “It helps us move beyond checklists and into conversations that matter — about people, systems, and the societies our standards help shape”. https://www.linkedin.com/in/simoneonofri/ 

Read more about the session on W3C’s official blog.

Sincerely,