Threat Modeling for ADA/WCAG Compliance

Why Accessibility Belongs in Your Threat Model

Most organizations treat digital accessibility as a content problem: someone finds a missing alt tag, fixes it, and moves on. I think that’s the wrong frame entirely. Digital accessibility is an organizational risk and governance gap, and once you see it that way, the right tool for the job isn’t a content checklist. It’s the same discipline we already use for application security: threat modeling and continuous technical monitoring.

The Same Method, a Different Risk Category

For years, I’ve taught developers and project teams how to enumerate risk systematically rather than fix things ad hoc as they’re noticed, making security part of the design and development process from the start. The method is simple to describe even if it takes practice to do well:

1. List what needs protecting. In application security, that’s private data, critical business functions, financial assets, and secrets. In accessibility, it’s the ability of every user, regardless of disability, to access a service, complete a transaction, or read a public document.
2. Enumerate what can go wrong. In security, we play cards like theft, fraud, exposed data, and interrupted business. In accessibility, the equivalent cards are things like unreadable documents for screen reader users, missing form labels, or PDFs with metadata that actively misidentifies content structure.
3. Score it, and make the score sortable. The classic risk score, whether you use a formal calculator, CVSS-style scoring, or something as simple as Fibonacci-style points, isn’t valuable because the number is objectively correct. It’s valuable because it lets you compare findings against each other and prioritize the fixes that matter most.

This is the exact methodology I cover in our full lecture on practical application security for developers, and it applies just as cleanly to a compliance gap as it does to a broken access control vulnerability. A risk is a risk. What changes is the domain.

Threat Modeling Scoring

Likelihood and impact are relative values you use to rank threats against each other, not absolute measurements. Consistency matters more than the specific number: score every threat in your model the same way, and the ranking holds up.

The computed risk score is used for sorting the threat modeling spreadsheet or for the development team to prioritize in Jira.

As I have long taught, the particular values of these scores are not written on stone tablets carried down from Mount Sinai. They’re useful for comparing like with like, for understanding which threat needs attention before another, or in the case of Metadata Minder, which document needs to be addressed first.

Metadata Minder provides a document score as shown in the screenshot at the lead-in to this article.

Corpus and Document Review

Most accessibility vendors focus on scanning websites, running automated tools across page after page to catch surface-level code errors like missing alt text or low color contrast. That covers only part of the risk surface.

Government agencies and regulated businesses don’t just publish web pages. They publish enormous document corpora, PDFs, Word files, spreadsheets, meeting minutes, budget reports, going back years. Automated web scanners rarely touch any of that beyond maybe the PDFs, and manual review of thousands of documents by hand doesn’t scale. That’s a real gap in most organizations’ risk management programs, and it’s the specific niche our Metadata Minder platform is built to close: scanning document repositories for hidden metadata faults that neither a web accessibility scanner nor a human reviewer flipping through pages by hand is likely to catch.

Just like a security audit doesn’t stop at “we ran a scanner,” a defensible accessibility program needs three ingredients:

• A documented, repeatable methodology, not a one-off click-through.
• A prioritized roadmap that ranks findings by user impact and severity, the same sortable scoring approach used in threat modeling, so remediation effort goes where it matters most first.
• An audit trail, independent evidence that the assessment happened, what it found, and what was done about it. That’s what turns “we think we’re compliant” into something you can actually show a regulator, an auditor, or opposing counsel.

Why a Cybersecurity Firm, Specifically

I imagine you are wondering why a cybersecurity firm would be the right choice for an ADA/WCAG audit at all.

Risk enumeration and sortable scoring are security skills. Now applied to a different kind of harm. The same evidence-based, independent methodology we use to verify a security claim, document a gap, and provide attestation produces a defensible ADA Title II or WCAG compliance record. We’re pointing an existing discipline at a risk category that has, for most organizations, been sitting unmanaged. I’ve made this case in more depth in my post on the Five Pillars of Information Security: accessibility is an availability problem, and availability is one of the five pillars security professionals already have a rigorous model for.

The Defender’s Dilemma Applied to the Accessibility Gap

As a cybersecurity professional, I do have to share one logical outcome of this effort. As the party publishing documents on the Internet, you are in the position of the defender who has to find every document and demonstrate a comprehensive program to achieve ADA compliance on your entire published corpus.

Once the enforcement deadline arrives, it only takes one noncompliant document for a claim against you to hold, and “we’re mostly compliant” won’t be a defense to that specific one. Our goal is to help you get ahead of that liability so you can be a good steward of your limited resources while providing accessibility at scale.

The Deadlines Make This Urgent

The Department of Justice has set firm ADA Title II compliance deadlines for state and local government web content and documents: April 26, 2027 for entities with a population of 50,000 or more, and April 26, 2028 for smaller entities and special district governments. See Extension of Compliance Dates for Nondiscrimination on the Basis of Disability; Accessibility of Web Information and Services of State and Local Government Entities, which I covered in an earlier post on the DOJ’s deadline extension. That’s not a long runway if your organization hasn’t inventoried its document corpus yet, let alone scored and prioritized the gaps in it.

If you’re responsible for compliance at a government agency or regulated organization, every large document corpus has accessibility gaps in it somewhere. Whether you have a defensible, evidence-based process for finding those gaps, scoring them, and fixing the ones that carry the most risk first is the real question.

It’s the same question we’ve been helping developers answer about their code for years. We just also happen to ask it about your published PDF, WordPerfect, Microsoft Office (Word, Excel, PowerPoint), and equivalent documents now.