ThreatForge

Overview

ThreatForge is an open-source threat-modeling app built around diagrams and automated STRIDE analysis. It suits developers and teams looking for a free tool without an enterprise procurement cycle. Its strongest case is a workflow that keeps models local and versionable; AI assistance is optional but requires your own API key.

Key features

The drag-and-drop canvas provides 44 typed components in 10 categories, alongside trust boundaries, annotations and automatically routed connections. Six templates span cloud microservices, e-commerce, mobile banking, SaaS, IoT smart buildings and healthcare systems. They offer useful starting points for those architectures, though teams with a different system design will need to build from the available components.

ThreatForge’s rule engine derives STRIDE threats from component types and data-flow patterns, and works offline. That makes the core analysis available without an AI service, but rule-generated findings are not a replacement for security judgment about a particular system. Optional Claude or GPT chat can suggest threats and mitigations or answer security questions. Bring your own API key, so this is an added capability rather than included AI access.

Models use human-readable YAML that teams can version and review in pull requests. This makes changes easier to track alongside code than a diagram-only workflow. The maker says models stay on the user’s machine and that the app has no telemetry. No account is required to start, and the download is described as approximately 10 MB.

Pricing

Threat Forge: free. The complete application is available under the Apache 2.0 license, with no freemium upsells or enterprise-only features. There is no free trial because the product is free. This is a strong fit for individuals and teams that want the full modeling tool without a paid tier; AI chat still depends on a user-provided key.

Platforms

ThreatForge supports Linux, macOS, Windows and the web. Its local-model approach is useful for teams that want to keep threat models on their own machine, while web support broadens platform choice.

Who it's for

Choose ThreatForge if you want diagram-based STRIDE modeling, offline rule analysis and YAML models that can be reviewed in a software development workflow. Its templates and no-account start lower the barrier to beginning a model. Look elsewhere if you need a different modeling method, or want AI assistance without supplying your own API key.

Pros and cons

• Pros: The full app is free and open source under Apache 2.0, with no account or enterprise-only feature gate.
• Pros: Offline STRIDE analysis and local model storage give teams a way to work without relying on AI services for core analysis.
• Pros: YAML models can be versioned and reviewed in pull requests, supporting a code-oriented team workflow.
• Cons: Claude and GPT assistance uses BYOK, so users must provide their own API key.
• Cons: STRIDE is the stated modeling method; teams looking for other methods may need a different tool.

Alternatives

For more options, browse Threat Modeling Software.

• CAIRIS is another free, open-source choice if its Linux, macOS, web, Windows or self-hosted availability better fits your deployment needs.
• OWASP Threat Dragon is a free open-source alternative with no paid plans or usage limits stated, and supports Linux, macOS, web, Windows and self-hosting.
• IriusRisk may suit a single user testing a freemium workflow: its Community Edition includes three active threat models and limited collaboration for one user.
• ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects and security teams who want to experience threat modeling before scaling.
• ThreatOpus is worth considering if a paid monthly plan fits: Starter costs £129.99 a month and includes 15 users, 10 team workspaces and 50 threat-modeling generations per month.
• ThreatTree has a free tier capped at three forests, three DFDs per forest and five Attack Trees per DFD; its Pro plan is $29 a month, billed per user monthly.
• AWS Threat Composer is another free option, with support for web, desktop and self-hosted platforms.
• itemis SECURE is a paid alternative for teams that prefer named-user or floating licenses and use web or Windows.

Verdict

ThreatForge is a strong choice for developers and teams who want free, open-source STRIDE modeling with offline analysis and models they can version alongside code. The combination of local storage, YAML and no account requirement makes it particularly suitable for a lightweight development workflow. Choose another tool if you need a different modeling method or AI help without bringing your own key.