Freedom251 › Threat Modeling Software
DevArmor
What DevArmor is
DevArmor automates threat modeling, security design reviews, and enforcement in software development workflows. It can create threat models from PRDs, RFCs, documentation, vulnerability reports, SAST results, architecture diagrams, and other artifacts. For new issues, it assesses security significance and places requirements, recommendations, and controls in the issue tracking platform. Its GitHub App reviews pull requests for potential vulnerabilities and deviations from security requirements and controls; suggested remediation is available when possible and labeled beta.
DevArmor connects security context and guardrails with Jira, Google Docs, GitHub, MCP, VS Code, and Cursor. It applies Policy-as-Code to each pull request, with an option to block unsafe merges. The maker says a threat model and requirements can be generated in less than 10 minutes. It documents security architecture and decisions in audit-friendly artifacts and can support work involving SOC 2 and ISO 27001. The service is cloud-based and available through web, API, extension, and self-hosted options. Pricing is usage-based with a platform fee, and is available on request. The maker says it is pursuing SOC 2 certification.
Who it suits
DevArmor is intended for security teams, developers, and coding agents working in software development workflows. It may suit teams seeking security requirements and controls in their issue and code review processes.
What it does well
- Builds threat models from a range of project artifacts.
- Reviews pull requests for potential vulnerabilities.
- Can block unsafe merges through Policy-as-Code.
- Connects with Jira, GitHub, VS Code, and Cursor.
- Offers self-hosted options for enterprise customers.
What to know first
- No free plan is listed.
- Pricing is on request and usage-based.
- Suggested remediation is labeled beta.
- The maker is pursuing SOC 2 certification.
Limits
There is no free plan. Usage-based pricing combines a platform fee with charges that scale by usage and features.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Usage-based pricing | Platform fee + usage-based model; contact DevArmor for pricing · Pricing scales with usage and features | On request |
As devarmor.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the DevArmor website
- Request a personalized demo
- Join the early access program
- Choose a web, API, extension, or self-hosted access option
- Connect listed workflow tools such as GitHub, Jira, VS Code, or Cursor
Verdict
DevArmor brings threat modeling and security controls into development workflows, with integrations and deployment options for different teams. Note that suggested remediation is beta and the maker says SOC 2 certification is still in progress.
Questions
How is DevArmor priced?
DevArmor uses paid, usage-based pricing with a platform fee. Pricing is available on request.
Which platforms can I use?
DevArmor is available through web, API, extension, and self-hosted options. Enterprise customers can choose single-tenant or self-hosted deployment.
Does it integrate with GitHub?
Yes. Its Code Review module is a GitHub App, and GitHub is also listed as a workflow integration.
Can DevArmor support compliance work?
It creates audit-friendly records of security architecture and decisions and can help with frameworks such as SOC 2 and ISO 27001.
Who is DevArmor for?
The maker describes it for security teams, developers, and coding agents working in software development workflows.
Facts from DevArmor's own pages
- Code review
- Its Code Review module is a GitHub App that reviews pull requests for potential vulnerabilities and deviations from security requirements and controls. · docs.devarmor.com, 9 Oct 2026
- Compliance
- The maker says DevArmor documents security architecture and decisions to produce audit-friendly artifacts, and can help with frameworks such as SOC 2 and ISO 27001. · devarmor.com, 9 Oct 2026
- Enterprise deployment
- A DevArmor migration article says enterprise customers can choose single-tenant and self-hosted options. · devarmor.com, 9 Oct 2026
- Headquarters
- San Francisco and New York City, United States · devarmor.com, 28 Sept 2026
- Intended users
- The maker describes the product as serving security teams, developers, and coding agents in software development workflows. · devarmor.com, 9 Oct 2026
- Policy enforcement
- DevArmor says it enforces Policy-as-Code on every pull request, with an option to block unsafe merges. · devarmor.com, 9 Oct 2026
- Remediation
- The documentation says the code review module can suggest remediation when possible and labels that capability beta. · docs.devarmor.com, 9 Oct 2026
- Security reviews
- It reviews new issues for security significance and delivers requirements, recommendations, and controls in the issue tracking platform. · docs.devarmor.com, 9 Oct 2026
- Security status
- The maker’s FAQ says it is pursuing SOC 2 certification and follows industry best practices for data protection. · devarmor.com, 9 Oct 2026
- Speed
- The maker says its workflow creates a threat model and generates requirements in less than 10 minutes. · devarmor.com, 9 Oct 2026
- Support and access
- The maker offers a personalized demo and says teams can join its early access program. · devarmor.com, 9 Oct 2026
- Threat modeling
- It can create threat models from PRDs, RFCs, documentation, vulnerability reports, SAST results, architecture diagrams, and other artifacts. · docs.devarmor.com, 9 Oct 2026
- What it does
- DevArmor automates threat modeling, security design reviews, and enforcement for software development. · docs.devarmor.com, 9 Oct 2026
- Workflow integrations
- The maker lists Jira, Google Docs, GitHub, MCP, VS Code, and Cursor as workflows where DevArmor provides security context or guardrails. · devarmor.com, 9 Oct 2026
Where DevArmor stands on Freedom251
- Threat Modeling Software#14 of 23