IriusRisk

IriusRisk is an AI-assisted threat-modeling platform for software security. It is best suited to security, development, and compliance teams that want to connect design-risk analysis with their existing engineering workflows. Its free individual edition offers a practical starting point, while teams need to weigh its limited seats, paid Enterprise path, and cloud data restrictions.

Overview

IriusRisk helps users build threat models, identify threats and countermeasures, and surface vulnerabilities and compliance gaps. Risk prioritization and collaborative review help teams move from identifying risks to discussing them, while multiple modeling methods and templates provide structure for that work. It is a focused option for secure software design, not a general-purpose diagramming product.

Jeff AI Assistant can turn user stories, documentation, meeting transcripts, or code into a threat-model diagram with threats and security controls. This gives teams a way to start from material they already have, but generated diagrams still need review by people who understand the system and its risks.

Key features

Standards and engineering workflows

The built-in knowledge base supports applying PCI DSS, NIST, and GDPR to threat models, marking aligned countermeasures as required. That helps teams bring those standards into modeling, though it does not replace the broader work of assessing compliance. Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and an Open API, linking the modeling workflow with issue tracking, development, and security tools.

Diagram imports and security

Users can import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool, which can ease a transition from existing design work. IriusRisk states that it holds ISO/IEC 27001 certification and maintains independently audited controls. Its trust hub describes encryption in transit and at rest, access controls, regular penetration testing, and incident response procedures. Those measures matter to organizations evaluating a security product, but they do not override the cloud service's stated data restrictions.

Pricing

Community Edition

Community Edition costs nothing and is a subscription for individuals. It allows one user and three active threat models, with limited collaboration, templates and libraries, XML diagram export, and technical and compliance reports. Those caps make it useful for an individual learning the workflow or modeling a small number of systems, but it is not a substitute for a team plan: the single seat constrains shared review, and the model cap limits parallel work.

Enterprise

Enterprise has custom pricing and is offered as SaaS or on-premise. It includes purchased threat models with no maximum, unlimited users, configurable deployment, OpenAPI, a dedicated Customer Success Manager, and enterprise onboarding. This is the relevant option for organizations that need scale, shared use, or on-premise deployment; the purchased-model basis and custom price mean buyers should confirm the commercial fit before committing. Standard, Gold, and Platinum support plans have varying availability, response times, and channels.

Platforms

IriusRisk supports API, self-hosted, and web use. Enterprise is available as SaaS or on-premise, giving organizations a deployment choice. Its cloud services are not designed or certified to process PHI, specially treated financial data, IDs, or GDPR special category data, so teams handling those categories should not assume cloud deployment is suitable.

Who it's for

Security teams, developers, CISOs, and compliance teams are the intended users. IriusRisk makes the most sense when threat modeling needs to connect to engineering systems and standards-based review. Individuals can start with Community Edition, but teams needing more than one user or three active models need to evaluate Enterprise. Organizations with sensitive data in the excluded categories should consider whether the on-premise option meets their requirements rather than using the cloud service.

Pros and cons

• Pros: AI-assisted diagram generation can start from stories, documentation, transcripts, or code, reducing the effort of turning project material into an initial model.
• Pros: Standards support, risk prioritization, collaborative review, diagram imports, and integrations give teams several ways to fit threat modeling into existing design and engineering work.
• Pros: Enterprise offers unlimited users and no maximum on purchased threat models, with SaaS or on-premise deployment.
• Cons: Community Edition is limited to one user and three active models, which rules it out as a broadly collaborative team plan.
• Cons: Cloud services are not designed or certified for several sensitive data categories, a material constraint for organizations that handle them.
• Cons: Enterprise uses custom pricing and purchased threat models, so the cost is less straightforward to assess than the free individual edition.

Alternatives

Threat Modeling Software is the broader category to browse if IriusRisk's cloud restrictions, free-plan caps, or Enterprise terms do not fit.

• CAIRIS is a free option for readers who want an Apache-licensed product with API, web, self-hosted, Linux, macOS, and Windows platforms.
• OWASP Threat Dragon is a free, open-source alternative for readers seeking Linux, macOS, Windows, web, or self-hosted availability.
• pytm is a free choice for readers who prefer an open-source tool from OWASP, a nonprofit focused on software security.
• ThreatForge is free and open source under Apache 2.0, with no account required and full application access, for readers prioritizing those terms.
• Threagile is a free, MIT-licensed open-source toolkit for readers looking for an API, web, Linux, or self-hosted option.
• ThreatModeler Nexus is another option with a free Community Edition for practitioners, students, developers, architects, and security teams.
• ThreatOpus is worth comparing for readers interested in a freemium tool with a free trial and a paid Starter plan priced at £129.99 a month.
• ThreatTree offers a free plan capped at three forests, three DFDs per forest, and five Attack Trees per DFD, for readers whose work fits those limits.

Verdict

IriusRisk is a strong fit for software security and compliance teams that want structured threat modeling tied to engineering workflows, standards, and shared review. Its individual free edition is genuinely useful for limited personal work, but its one-user and three-model caps make Enterprise the team path. Choose it when those workflows and deployment options justify custom pricing; look elsewhere if the cloud data exclusions or Enterprise commercial terms make it a poor fit.