The threat model of a social network is complex. Your security team has to deal with conventional hacking attacks, as hostile actors probe for technical errors in your apps and servers that they can use to extract valuable private data, inject malicious code, or simply wreak havoc for fun.
They also have to deal with people using the site’s own capabilities in destructive ways, from simple-minded spam bots through to nation states carrying out “coordinated inauthentic behaviour”. They have to protect users from account takeovers due to password theft, and they have to do it all while navigating the minefield that is content moderation.
