Free and open first
Best Threat Modeling Software in 2026
Security teams use threat modeling to structure the identification and review of risks in systems. Compare modeling methods, templates and frameworks, and risk prioritization to see which approaches align with your process. Attack-path analysis and collaborative review are additional factors, while deployment and project limits can affect how a tool fits your work. Free plans and paid-from pricing are listed for cost comparison. CAIRIS, OWASP Threat Dragon and ThreatForge are among the options shown. Think about how your team models threats and reviews findings, then weigh the listed capabilities against that workflow.
- 23 apps
- Research read 23 Sept 2026
- How the order is worked out
- 1
Dethernety
Free plan Open source APISelf-hostedWebChoose Dethernety if you need graph-based threat modeling with local hosting, architecture-aware analysis, and CLI automation.
- 2
CAIRIS
Free plan APILinuxMac+3CAIRIS links system design information with generated views, threat models and security analysis.
- 3
AWS Threat Composer
Free plan APIExtensionLinux+4AWS Threat Composer combines structured threat writing, visual modeling, and multiple export options. Consider the experimental status and Bedrock costs before relying on its AI tools.
- 4
IriusRisk
Free plan APISelf-hostedWebIriusRisk offers threat modeling workflows, integrations and a free individual edition with defined limits.
- 5
OWASP Threat Dragon
Free plan LinuxMacSelf-hosted+2Threat Dragon offers threat diagrams, framework support and rule-based suggestions at no charge. Its volunteer-maintained project notes that incident investigation or response may not be immediate.
- 6
Threagile
Free plan APILinuxSelf-hosted+1Threagile offers a code-oriented approach to threat modeling, with YAML models, configurable risk rules, and workflow integrations.
- 7
pytm
Free plan LinuxMacWindowsChoose pytm if you want to describe an architecture in Python and generate threat findings, diagrams, reports, or slides from it.
- 8
ThreatForge
Free plan LinuxMacWeb+1ThreatForge brings diagramming, offline STRIDE analysis and optional AI assistance into a free, open-source app.
- 9
ThreatModeler Nexus
Free plan APISelf-hostedWebThreatModeler Nexus connects threat modeling with architecture, compliance, and development workflows, with options for web, API, and self-hosted environments.
- 10
ADTool
Free planADTool provides tree-based modeling and quantitative analysis for attack-defense scenarios, with options to rank attacks and export models.
- 11
ThreatOpus
Free plan APIWebThreatOpus links threat modelling to pull request policy checks and offers retention and data controls.
- 12
ThreatTree
Free plan APIWebThreatTree combines threat diagrams, risk ranking, framework tags and control mappings with collaboration and export options.
- 13
TSpec
Free planPick TSpec if you develop TypeScript applications on Node.js and want a free framework with assertions, mocks, and watch mode.
- 14
DevArmor
Paid APIExtensionSelf-hosted+1DevArmor brings threat modeling and security controls into development workflows, with integrations and deployment options for different teams.
- 15
CYMETRIS
Paid APISelf-hostedWebCYMETRIS combines a standards-aligned TARA workflow with attack-path analysis, reporting, and several deployment options.
- 16
Microsoft Threat Modeling Tool
Free plan Windows - 17
ThreatZ
Free trial APISelf-hostedWebThreatZ combines automotive threat modeling, evidence management, and compliance outputs for vehicle programs.
- 18
AutoSec TARA Suite
Paid Self-hostedWebChoose AutoSec TARA Suite if your team needs a structured automotive TARA workflow and listed compliance deliverables during a pilot engagement.
- 19
itemis SECURE
Paid WebWindowsitemis SECURE combines visual TARA modeling, risk prioritization, and report generation, with web and Windows deployment options.
- 20
SD Elements
Paid APISelf-hostedWebSD Elements links architecture and compliance context with developer requirements, training, and validation options.
5.4 Visit site - 21
KAVACH
Paid WindowsChoose KAVACH if your automotive programme needs connected cybersecurity workflows, evidence, and deployment within a customer-defined boundary.
- 22
EnCo SOX ATA
Paid WebWindowsChoose EnCo SOX ATA if your engineering team needs attack tree modeling linked to TARA, requirements and system design.
- 23
ThreatModeler CloudModeler
Paid Web
#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price
More in Developer Tools
- Time-Series Databases36
- UML Modeling Software26
- Unit Testing Frameworks32
- Uptime Monitoring Software48
- Value Stream Management Software22
- Vector Databases27
- Version Control Software62
- Virtual machine software24
- Visual Regression Testing Software26
- Vulnerability Scanning Software35
- Web Debugging Proxies27
- Web Development IDEs44