IriusRisk is an AI threat modeling tool for secure software design. It helps teams create threat models, identify threats and countermeasures, and review vulnerabilities and compliance gaps. Its Jeff AI Assistant can generate a threat model diagram with threats and security controls from user stories, documentation, meeting transcripts or code. The built-in knowledge base supports applying standards such as PCI DSS, NIST and GDPR, and marks aligned countermeasures as required. Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation and an Open API. Users can import diagrams from draw.io, Visio, Lucidchart and Microsoft Threat Modeling Tool. The free Community Edition is limited to one user and three active threat models; Enterprise is offered as SaaS or on-premise, with no price listed. IriusRisk states that its cloud services are not designed or certified for certain sensitive data, including PHI, specially treated financial data, IDs and GDPR special category data.
Who it is for
It is intended for security teams, developers, CISOs and compliance teams creating threat models for software. The free edition may suit an individual with up to three active models.
What is good
- AI can build threat diagrams from several input types.
- Knowledge base supports PCI DSS, NIST and GDPR.
- Integrates with development, security and cloud tools.
- Can import diagrams from four listed applications.
What to know first
- Community Edition is limited to one user.
- Community Edition allows three active threat models.
- Cloud services are not designed for specified sensitive data.
- No free trial is listed.
Verdict
IriusRisk offers threat modeling workflows, integrations and a free individual edition with defined limits. Check the cloud data restrictions and the Enterprise deployment and pricing details against your needs.
IriusRisk plans and pricing
All plansCompared on threat modeling software
- Free plan
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
- Templates and frameworks
- Yes
- Modeling methods
- multiple
- Deployment
- both
