Here’s a great case study of how the World Wide Web Consortium (W3C) has used LEGO® Serious Play® to do threat modeling around digital identity.
If you aren’t familiar with it, LEGO Serious Play is a business facilitation technique for helping groups brainstorm difficult and/or abstract concepts. And yes, it uses LEGO bricks as part of that process.
The kinds of problems that are best for LEGO Serious Play are difficult problems that don’t have simple answers. When I’m working in-person with teams, I regularly use Serious Play for retrospectives, or to create team working agreements.
Why LEGO? Isn’t that just a child’s toy?
There are significant neurological benefits to working this way, and I talked about a number of them in this article on learning with LEGO.
In addition to that, when using a large connected build, like the one described in the W3C threat model, there are powerful insights generated from the positioning of items and the connections between them. Having that physical spacial connection, dramatically helps with brainstorming.
The W3C article only shows a simple connected build so I’ve included this picture from one I was involved in. You can see that there are different kinds of connections, with varying lengths, shapes, and levels of rigidity. There is meaning in all of those attributes and that meaning becomes apparent as the build continues.
It’s been a decade since I first took LEGO Serious Play facilitator training, and I’ve used it a lot since then, always with positive results. If you’re interested in trying this with your teams then let’s talk.
See also: How I teach technical practices with LEGO. Not Serious Play but still LEGO and with many of the same benefits.