Side by side
pytm vs ThreatOpus
Both stand on threat modeling software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan LinuxMacWindows
Choose pytm if you want to describe an architecture in Python and generate threat findings, diagrams, reports, or slides from it. Account for its Python and diagram-tool requirements, and protect threats.json because its strings are evaluated with eval().
Visit pytm
Free plan APIWeb
ThreatOpus links threat modelling to pull request policy checks and offers retention and data controls. Treat its generated results as support for security work, not a replacement for professional assessment or testing.
Visit ThreatOpusThe facts
| pytm | ThreatOpus | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Linux, Mac, Windows | API, Web |
| Lowest paid plan | Free or on request | Starter: £129.99 a month |
| Plans published | 1 | 4 |
| Maker | Not published | Not published |
| Website | github.com | threatopus.com |
| On threat modeling software | #7 of 23 | #11 of 23 |
pytm: what it does well
- Builds models from Python-defined architecture elements.
- Generates data flow diagrams, sequence diagrams, and threats.
- Templates can produce reports and browser-presentable slides.
- Supports JSON model import and custom threat definitions.
- Finding attributes such as severity and CVSS score can be overridden.
What to know first
- Diagram generation requires Graphviz and Java/PlantUML.
- Windows setup is documented through WSL.
- Strings in threats.json are evaluated with eval().
ThreatOpus: what it does well
- Generates STRIDE threats from descriptions, imports, or GitHub repositories.
- Merge Guard posts policy decisions and reasons to CI checks.
- Supports listed source control and CI integrations.
- Project settings provide input and output retention controls.
- Users can export data as JSON or delete created content.
What to know first
- Generated threats do not replace professional assessment.
- Starter allows 15 users and 10 repositories.
- Free plan allows five threat modelling generations monthly.
- Enterprise pricing is custom and not listed.
Alternatives to pytm Alternatives to ThreatOpus The whole list