Best Threat Modeling Software in 2026
Updated
In short: CAIRIS is ranked #1 of 22 as of 4 October 2026, ahead of OWASP Threat Dragon and IriusRisk. The best-ranked option with a free plan is OWASP Threat Dragon. The lowest first paid tier on this page is ThreatZ at $8.33/mo.
Security teams use threat modeling to structure the identification and review of risks in systems. Compare modeling methods, templates and frameworks, and risk prioritization to see which approaches align with your process. Attack-path analysis and collaborative review are additional factors, while deployment and project limits can affect how a tool fits your work. Free plans and paid-from pricing are listed for cost comparison. CAIRIS, OWASP Threat Dragon and ThreatForge are among the options shown. Think about how your team models threats and reviews findings, then weigh the listed capabilities against that workflow.
22 threat modeling software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
6 of the 22 here have a free tier you can use, 0 have open-source code on record, and 0 have full bars: free, open, on most of your devices and documented.
| # | App | Signal | Free tier | Open code | Devices | From | Score |
|---|---|---|---|---|---|---|---|
| 1 | CAIRISWeb · Windows · Mac · Linux · Self-hosted · API | Three bars | — | 4 of 6 | Free | 6.6 | |
| 2 | OWASP Threat DragonWeb · Windows · Mac · Linux · Self-hosted | Three bars | — | 4 of 6 | Free | 6.6 | |
| 3 | IriusRiskWeb · Self-hosted · API | Two bars | — | 1 of 6 | Free | 6.4 | |
| 4 | ThreatModeler NexusWeb · Self-hosted · API | Two bars | — | 1 of 6 | $333.33/mo | 6.4 | |
| 5 | ThreatOpusWeb · API | Two bars | — | 1 of 6 | £129.99/mo | 6.4 | |
| 6 | ThreatTreeWeb · API | Two bars | — | 1 of 6 | $29/mo | 6.4 | |
| 7 | AWS Threat ComposerWeb · Windows · Mac · Linux · Self-hosted · API · Extension | Two bars | — | — | 4 of 6 | — | 5.7 |
| 8 | itemis SECUREWeb · Windows | One bar | — | — | 2 of 6 | — | 5.5 |
| 9 | ThreatForgeWeb · Windows · Mac · Linux | One bar | — | — | 4 of 6 | — | 5.4 |
| 10 | pytmWindows · Mac · Linux | One bar | — | — | 3 of 6 | — | 5.3 |
| 11 | AutoSec TARA SuiteWeb | No signal | — | — | 1 of 6 | — | 5.2 |
| 12 | DethernetyWeb | No signal | — | — | 1 of 6 | — | 5.2 |
| 13 | Microsoft Threat Modeling ToolWindows | No signal | — | — | 1 of 6 | — | 5.2 |
| 14 | ThreagileWeb | No signal | — | — | 1 of 6 | — | 5.2 |
| 15 | ADToolNo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 16 | EnCo SOX ATANo platforms listed | No signal | — | — | 0 of 6 | — | 5.1 |
| 17 | CYMETRISWeb · Self-hosted · API | One bar | — | — | 1 of 6 | €99/mo | 5.0 |
| 18 | ThreatZWeb · Self-hosted · API | One bar | — | — | 1 of 6 | $8.33/mo | 5.0 |
| 19 | TSpecNo platforms listed | No signal | — | — | 0 of 6 | — | 4.9 |
| 20 | KAVACHNo platforms listed | One bar | — | — | 0 of 6 | — | 4.8 |
| 21 | SD ElementsWeb | One bar | — | — | 1 of 6 | — | 4.8 |
| 22 | DevArmorWeb | No signal | — | — | 1 of 6 | — | 4.7 |
Compare all 22 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | Project limit | Attack-path analysis |
|---|---|---|---|---|---|---|---|---|
| 1 | CAIRIS | 6.6 | Free plan | Free | Yes | — | — | Yes |
| 2 | OWASP Threat Dragon | 6.6 | Free plan | Free | Yes | — | — | — |
| 3 | IriusRisk | 6.4 | Free plan | Free | Yes | — | — | — |
| 4 | ThreatModeler Nexus | 6.4 | Free plan | $333.33/mo | Yes | — | — | Yes |
| 5 | ThreatOpus | 6.4 | Free plan | £129.99/mo | Yes | — | — | Yes |
| 6 | ThreatTree | 6.4 | Free plan | $29/mo | Yes | — | — | Yes |
| 7 | AWS Threat Composer | 5.7 | No | — | Yes | — | — | — |
| 8 | itemis SECURE | 5.5 | No | — | — | — | — | Yes |
| 9 | ThreatForge | 5.4 | No | — | Yes | — | — | — |
| 10 | pytm | 5.3 | No | — | — | — | — | — |
| 11 | AutoSec TARA Suite | 5.2 | No | — | — | — | — | No |
| 12 | Dethernety | 5.2 | No | — | — | — | — | Yes |
| 13 | Microsoft Threat Modeling Tool | 5.2 | No | — | Yes | — | — | — |
| 14 | Threagile | 5.2 | No | — | — | — | — | — |
| 15 | ADTool | 5.1 | No | — | Yes | — | — | Yes |
| 16 | EnCo SOX ATA | 5.1 | No | — | — | — | — | Yes |
| 17 | CYMETRIS | 5.0 | No | €99/mo | No | — | 5 projects | Yes |
| 18 | ThreatZ | 5.0 | No | $8.33/mo | No | — | 3 projects | Yes |
| 19 | TSpec | 4.9 | No | — | Yes | — | — | — |
| 20 | KAVACH | 4.8 | No | — | No | — | — | Yes |
| 21 | SD Elements | 4.8 | No | — | No | — | — | — |
| 22 | DevArmor | 4.7 | No | — | No | — | — | — |
Is your app on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which threat modeling software is ranked first on Freedom251?
CAIRIS is ranked #1 of 22 with a score of 6.6. OWASP Threat Dragon is second and IriusRisk third.
How many of these have a free plan?
6 of the 22 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, ThreatZ has the lowest first paid tier we found: $8.33/mo.
How is this list ranked?
Ranked free-and-open first: a usable free tier and open-source code, then the platforms it runs on and its documentation.