ThreatTree

Free plan APIWeb

What ThreatTree is

ThreatTree is a browser-based threat-modeling tool that groups work into forests containing Data Flow Diagrams and Attack Trees. It scores risk by likelihood and impact, then creates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC and MITRE ATT&CK, while mitigations can be mapped to standards such as ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0 and SOC 2. Invited collaborators can have owner, editor or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is offered on every plan, including Free. ThreatTree says data is kept on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are made daily and retained for 30 days. Free allows up to three forests, three DFDs per forest and five Attack Trees per DFD. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote. ThreatTree says it is not currently SOC 2 or ISO 27001 certified.

Who it suits

ThreatTree suits security teams, from solo consultants to CISO organizations, that need to model threats and prioritize risk. Its collaboration roles support invited team members.

What it does well

Ranks risks by likelihood and impact
Supports multiple threat frameworks and control standards
Exports PDF, JSON and STIX 2.1 reports
Optional AES-256-GCM encryption is available on every plan

What to know first

Free plan limits forests and diagrams
Pro costs $29 a month per user
Enterprise pricing is by quote
Not currently SOC 2 or ISO 27001 certified

Limits

The Free plan allows up to 3 forests, up to 3 DFDs per forest, and up to 5 Attack Trees per DFD. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote.

Plans

Plan	Billed and limits	Price
Free	Up to 3 forests · Up to 3 DFDs per forest · Up to 5 Attack Trees per DFD	Free
Pro	per user, monthly · Unlimited forests & trees · Team collaboration · Full report generation · Priority support	$29 a month
Enterprise	Quote on request; pricing depends on org size & requirements · SSO/SAML · Custom roles and data retention · Multi-org management · Custom integrations · Dedicated/VPC deployment option · Dedicated support & SLA	On request

As threattree.com lists them, read 30 Sept 2026. The maker's own page has the final word.

Getting started

Open the ThreatTree website.
Choose the Free plan or review Pro at $29 a month per user.
Create a forest and add Data Flow Diagrams and Attack Trees.
Tag threats with a supported framework and map mitigations to a standard.
Invite collaborators and assign owner, editor, or viewer roles.

Verdict

ThreatTree combines threat diagrams, risk ranking, framework tags and control mappings with collaboration and export options. Its free plan has modeling limits, and the maker says the product is not currently SOC 2 or ISO 27001 certified.

Questions

Does ThreatTree have a free plan?

Yes. Free costs nothing and allows up to 3 forests, 3 DFDs per forest, and 5 Attack Trees per DFD.

How much does Pro cost?

Pro costs $29 a month, billed per user monthly.

Which platforms can I use?

ThreatTree lists web and API platforms and describes itself as browser-based.

Is ThreatTree open source?

The listed facts do not identify ThreatTree as open source.

Is ThreatTree SOC 2 or ISO 27001 certified?

ThreatTree says it is not currently SOC 2 or ISO 27001 certified and that formal certification is on its roadmap.

What integrations are listed for Enterprise?

Enterprise lists custom Jira and ServiceNow ticketing, Terraform/OpenAPI architecture import, Splunk and Microsoft Sentinel feeds, GRC platform sync, and Confluence/Notion embeds.

Facts from ThreatTree's own pages

Backups: Database backups are taken daily, retained for 30 days, encrypted, and stored separately from the primary data store. · threattree.com, 30 Sept 2026
Certification: ThreatTree says it is not currently SOC 2 or ISO 27001 certified and that formal certification is on its roadmap. · threattree.com, 30 Sept 2026
Collaboration: The product supports owner, editor, and viewer roles for invited team members. · threattree.com, 30 Sept 2026
Controls: Mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. · threattree.com, 30 Sept 2026
Encryption: Optional per-forest AES-256-GCM encryption is available on every plan, including Free. · threattree.com, 30 Sept 2026
Frameworks: Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK. · threattree.com, 30 Sept 2026
Headquarters: United Kingdom · threattree.com, 28 Sept 2026
Hosting and transport: ThreatTree says data is stored on UK servers and connections use TLS 1.2 or higher. · threattree.com, 30 Sept 2026
Integrations: The Enterprise plan lists custom Jira and ServiceNow ticketing, Terraform/OpenAPI architecture import, Splunk and Microsoft Sentinel feeds, GRC platform sync, and Confluence/Notion embeds. · threattree.com, 30 Sept 2026
Intended users: ThreatTree describes itself as a browser-based tool for security teams ranging from solo consultants to CISO organizations. · threattree.com, 30 Sept 2026
Maker location: The maker says its team is based in the United Kingdom. · threattree.com, 30 Sept 2026
Purpose: ThreatTree organizes threat models into forests containing Data Flow Diagrams and Attack Trees. · threattree.com, 30 Sept 2026
Reports and exports: ThreatTree offers PDF reports and supports JSON and STIX 2.1 exports. · threattree.com, 30 Sept 2026
Risk analysis: Likelihood-by-impact scoring automatically generates a ranked risk register across trees in a forest. · threattree.com, 30 Sept 2026
Support: The pricing page lists priority support with Pro and dedicated support and an SLA with Enterprise. · threattree.com, 30 Sept 2026

Where ThreatTree stands on Freedom251

Threat Modeling Software#12 of 23