Learn Threat Modeling with LEGO® SERIOUS PLAY®. A Workshop on Spanish Age Verification.
🚀 ISC2 Spanish Chapter hosts the W3C’s Threat Modeling Community Group in Madrid
Join us on 📅 23 February 2026, from ⏰ 18:00–21:30, at 📍 Universidad Politécnica de Madrid, ETSIST Campus Sur, Madrid, for an in-person session organized by ISC2 Spanish Chapter.
🔍 This is a practical learning session designed to teach a transferable threat modeling skill you can apply in your work or studies across enterprise, university, and government environments.
We will use a timely, concrete use case: Age Verification in Spain, including the Spanish age verification initiative “Cartera Digital Beta”, aligned with the European Digital Identity Wallet direction and based on eIDAS2.
Instead of starting with abstract threats, we will build them together and use that shared model to identify them.
The goal is not just to “analyze age verification,” but to learn a method you can reuse for your own systems — from IAM and wallets to AI-enabled services and critical infrastructure.
🔍 From threats to harms — and back to root causes
Age verification is not only a technical challenge; it is also designed to sit at the intersection of security, privacy, compliance, and human rights.
This workshop goes beyond traditional threat lists to explore high-impact harms and risks—including exclusion, discrimination, and profiling—and trace them back to their technical and governance causes (architecture choices, operational practices, policy constraints, ecosystem dependencies).
🧱 Facilitators
Simone Onofri, Security Lead at W3C, and Luca Lumini, Officer for Education at ISC2 Spanish Chapter, certified Facilitators from the Association of Master Trainers in the LEGO® SERIOUS PLAY® Method, will facilitate the workshop.
What to Expect
🧠 Threat Modeling with LEGO® SERIOUS PLAY® (LSP).
LEGO® SERIOUS PLAY® is a facilitation methodology based on learning through making. By building physical models, participants externalize assumptions, surface hidden risks, and engage in inclusive, system-level thinking. No LEGO® skills required - just curiosity and openness.
🤝 Collaboration and Discussion through the LSP core process
Participants will first work individually to build their own threats; then they will share their insights; and finally, they will discuss and build a shared threat model.
The workshop follows the LEGO® SERIOUS PLAY® core process, a structured facilitation flow designed to surface individual insights and build shared understanding:
● Listen: The facilitator poses the building challenge, framing the question or problem space.
● Build: Each participant individually builds their own LEGO® model to answer the question.
● Share: In turn, and while the others listen, each participant shares the meaning and story behind their model with the rest of the table.
● Reflect: The facilitator and participants crystallize key insights.
This rhythm allows complex technical, social, and ethical risks to emerge organically and be examined collaboratively.
Earn Valuable CPE Credits
ISC2 members attending this event may apply for 2 Group A CPEs to maintain their ISC2 certifications – from CC to CISSP. Please register yourself with the same email address used to access your ISC2 profile.
CPEs should be self-reported in accordance with the requirements, policies, and procedures in the ISC2 Certification Maintenance Handbook.
Community support
👉This event is supported by the Threat Modeling Connect - Barcelona Chapter, a local community of professionals dedicated to Threat Modeling in Barcelona.