Personal cybersecurity discourse in 2026 oscillates between two unhelpful extremes: 'everything is fine, just use a password manager' and 'every device is compromised, here are 47 things you must do today.' The actual evidence-based threat model for most adults sits in the middle and is dominated by a small number of attack vectors: credential stuffing from old breaches, SIM-swapping, phishing, and account-recovery flow weaknesses. This page is for someone who wants to handle their security pragmatically without becoming an enthusiast, organized by what each part of the practice does: the foundational tools every adult should use, the threat-model upgrades worth knowing about, the device-hardening basics, and the writers and resources worth following for staying current. One deliberate omission: corporate enterprise security is not covered — that's a different practice with different priorities and very different threat models.

A 2026 personal-cybersecurity syllabus calibrated to actual threat models, not anxiety.