Freedom251 › Threat Modeling Software
ThreatOpus
What ThreatOpus is
ThreatOpus combines threat modelling with pull request security checks, returning PASS, WARN, or FAIL decisions in a CI pipeline. Teams can describe a system, import it from OpenAPI or Terraform, or link a GitHub repository; the tool then generates STRIDE threats and supports mitigation tracking. STRIDE is available on every plan, while Pro adds nine more threat modelling frameworks. Merge Guard checks pull requests against policy bundles and posts its decisions, with reasons, to CI checks. Listed source control and CI connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI. Outcome notices can be sent to Slack and Microsoft Teams, and scoped API keys support custom pipeline steps or internal orchestration. Users can manage architecture-input retention, export their data as JSON, or delete content they created. A free plan and free trial are available; Starter is £129.99 per month. ThreatOpus says its generated threats and mitigations support security work but are not a substitute for professional assessment, penetration testing, or formal risk acceptance.
Who it suits
ThreatOpus describes its intended users as security teams, security champions, and platform engineers seeking governed threat models and clear merge decisions. It may suit teams that want threat modelling and pull request checks connected to their listed source control and CI tools.
What it does well
- Generates STRIDE threats from descriptions, imports, or GitHub repositories.
- Merge Guard posts policy decisions and reasons to CI checks.
- Supports listed source control and CI integrations.
- Project settings provide input and output retention controls.
- Users can export data as JSON or delete created content.
What to know first
- Generated threats do not replace professional assessment.
- Starter allows 15 users and 10 repositories.
- Free plan allows five threat modelling generations monthly.
- Enterprise pricing is custom and not listed.
Limits
The free plan allows 3 users, 1 team workspace, 5 threat modelling generations per month, 1 repository, and 1 SCM or CI provider. Starter is £129.99/month and allows 15 users, 10 workspaces, 50 generations monthly, and 10 repositories.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Starter | £129.99/month · 15 users · 10 team workspaces · 50 threat modelling generations/month · 10 repositories · All SCM and CI providers · Email support | £129.99 a month |
| Pro | £299.99/month · 50 users · 25 team workspaces · 250 threat modelling generations/month · 50 repositories · 9 additional threat modelling frameworks · 8 hours expert consultation/month · Priority support | £299.99 a month |
| Enterprise | Custom · Custom users and repositories · Unlimited workspaces and threat modelling generations · All SCM and CI providers · SSO · Priority support | On request |
| Free | £0.00/month · 3 users · 1 team workspace · 5 threat modelling generations/month · 1 repository · 1 SCM or CI provider · STRIDE | On request |
As threatopus.com lists them, read 30 Sept 2026. The maker's own page has the final word.
Getting started
- Open the ThreatOpus website.
- Use the web platform or API.
- Create an account using email verification.
- Describe a system, import from OpenAPI or Terraform, or link a GitHub repository.
- Connect a listed source control or CI provider for pull request checks.
- Start with the free plan or free trial, or choose a paid plan starting at £129.99/month.
Verdict
ThreatOpus links threat modelling to pull request policy checks and offers retention and data controls. Treat its generated results as support for security work, not a replacement for professional assessment or testing.
Questions
Does ThreatOpus have a free plan?
Yes. The free plan includes 3 users, 1 team workspace, 5 threat modelling generations per month, 1 repository, and 1 SCM or CI provider.
How much do paid plans cost?
Starter costs £129.99/month and Pro costs £299.99/month. Enterprise uses custom pricing.
Is there a free trial?
Yes, ThreatOpus offers a free trial.
Which threat modelling methods are included?
STRIDE is available on every plan. Pro adds nine additional threat modelling frameworks.
Which source control and CI integrations are listed?
GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI.
Do generated threats replace professional security assessment?
No. ThreatOpus says generated threats and mitigations support security work but do not replace professional assessment, penetration testing, or formal risk acceptance.
Facts from ThreatOpus's own pages
- API keys
- PR Security supports scoped API keys for custom pipeline steps or internal orchestration. · threatopus.com, 30 Sept 2026
- Assessment limitation
- ThreatOpus says generated threats and mitigations support security work but do not replace professional assessment, penetration testing, or formal risk acceptance. · threatopus.com, 30 Sept 2026
- Authentication
- Accounts use email verification and password policies, sessions use httpOnly cookies, and optional two-factor authentication is available in user settings. · threatopus.com, 30 Sept 2026
- Data export and deletion
- Signed-in users can export their data as JSON and delete content they created through Data controls. · threatopus.com, 30 Sept 2026
- Integrations
- Listed source control and CI integrations include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI. · threatopus.com, 30 Sept 2026
- Intended users
- ThreatOpus describes its intended users as security teams, security champions, and platform engineers seeking governed threat models and clear merge decisions. · threatopus.com, 30 Sept 2026
- Methodologies
- STRIDE is available on every plan, while Pro adds nine additional threat modelling frameworks. · threatopus.com, 30 Sept 2026
- Notifications
- ThreatOpus can send check outcome notifications to Slack and Microsoft Teams. · threatopus.com, 30 Sept 2026
- Product
- ThreatOpus combines threat modelling with pull request security checks that return PASS, WARN, or FAIL outcomes in a CI pipeline. · threatopus.com, 30 Sept 2026
- PR security
- Merge Guard evaluates pull requests against policy bundles and returns decisions with reasons posted to CI checks. · threatopus.com, 30 Sept 2026
- Retention controls
- Project settings let users choose whether raw architecture input is stored, set its retention period, and decide whether structured threat output remains after raw input expires. · threatopus.com, 30 Sept 2026
- Subprocessors
- ThreatOpus says it does not sell personal data and that customers can request a subprocessor list for security review. · threatopus.com, 30 Sept 2026
- Support
- The pricing page lists email support on Starter and Pro, and priority support on Pro and Enterprise. · threatopus.com, 30 Sept 2026
- Threat modelling
- Teams can describe a system, import from OpenAPI or Terraform, or link a GitHub repository to generate STRIDE threats and track mitigations. · threatopus.com, 30 Sept 2026
Where ThreatOpus stands on Freedom251
- Threat Modeling Software#11 of 23