Human-Centered Threat Modeling for Digital Identity Systems: A LEGO® SERIOUS PLAY® Workshop
🚀 Threat Modeling Connect returns to Barcelona — Round Two
The second workshop in the series, which is based on the first one's momentum and insights, is going to be all about delving even deeper into human-centered threat modeling and responsible innovation.
Join us on 📅 24 February 2026, from ⏰ 18:00–21:00, at 📍 Geneva Business School, Barcelona, for an in-person session organized by Threat Modeling Connect Barcelona Chapter.
🥤🍕 Drinks and pizzas will be provided, so you can focus on learning, building, and discussing in a relaxed setting.
Simone Onofri, Security Lead at W3C, and a certified LEGO® SERIOUS PLAY® facilitator, will facilitate the workshop, considering the importance of having security, privacy, and human rights by design, in innovative technologies.
This second round builds directly on the outcomes of the October workshop, moving beyond initial mappings to analyze more critical, complex, and systemic harms and threats emerging from digital identity technologies, such as those related to the European Digital Identity Wallet (EUDI Wallet), and Identity and Access Management frameworks.
What to expect
🧱 Threat Modeling with LEGO® SERIOUS PLAY® (LSP)
LEGO® SERIOUS PLAY® is a facilitation methodology based on learning through making. By building physical models, participants externalize assumptions, surface hidden risks, and engage in inclusive, systems-level thinking. No LEGO skills required — just curiosity and openness.
🔍 From deeper harms to critical threats
This session focuses on high-impact harms — including discrimination, exclusion, profiling, and human rights implications — and traces them back to their technical and governance causes through a structured threat modeling process.
🤝 Collaboration and Discussion
Participants will first work individually building their own threats; then they will share their insights, and finally, they discuss and build a shared threat model.
🧠 The LEGO® SERIOUS PLAY® core process
The workshop follows the LEGO® SERIOUS PLAY® core process, a structured facilitation flow designed to surface individual insights and build shared understanding:
Listen: The facilitator poses the building challenge, framing the question or problem space.
Build: Each participant individually builds their own LEGO model to answer the question.
Share: In turn, and while the others listen, each participant shares the meaning and story behind their model with the rest of the table.
Reflect: The facilitator and participants crystallize key insights.
This rhythm allows complex technical, social, and ethical risks to emerge organically and be examined collaboratively.
Community support
🇪🇸 This event is supported by the Spanish Chapter of (ISC)², a local community of professionals dedicated to promoting and advancing information security and cybersecurity in Spain.