OWASP Threat Dragon helps teams draw a system’s data flows, attach threats and mitigations to diagram elements, and keep that analysis with the model. Use it to organize a threat-modeling session—not to decide whether a system is secure or whether the analysis is complete. People who understand the architecture still need to check assumptions, trust boundaries, threats, and proposed mitigations.
What is Threat Dragon?
OWASP describes Threat Dragon as a free, open-source, cross-platform application for drawing threat-model diagrams and listing threats for diagram elements. Its central artifact is a data-flow diagram: components and the connections between them provide context for recording security concerns. Threat details are saved alongside the diagram in a text-based model file, and the tool can produce a PDF report containing the diagram and associated threats. OWASP project page · OWASP Developer Guide
As an Amazon Associate I earn from qualifying purchases.
The application supports several threat categorization approaches and includes a rule engine that can suggest or generate threats and mitigations. Treat those results as prompts for discussion: the project material does not establish that generated items are correct, exhaustive, or appropriate for a particular system. Threat Dragon does not certify a model or replace a team’s security judgment.
Choose a deployment and decide where models will live
Threat Dragon has desktop and web variants. The desktop application is available for Windows, macOS, and Linux and saves models locally. The web application can use local files or be configured for repository and cloud storage. OWASP documents GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise, and GitLab as options. External repository access requires registering the application with the relevant repository account. Threat Dragon documentation · OWASP Threat Dragon repository
#1 Best Overall
| Choice | Deployment and operations | Model storage | Useful when |
|---|---|---|---|
| Desktop | Install the app on Windows, macOS, or Linux. | Models are saved locally. | An individual or small working session needs a local workflow without setting up a team web deployment. |
| Web | Run the web application from source or in a container; the team must operate or arrange its deployment. | Use local files or configure one of the documented repository/cloud providers: GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise, or GitLab. | A team wants its model workflow to fit an existing configured storage provider. |
For a repository-backed workflow, confirm that the organization permits the integration and that the application has the necessary registration and access. The location of a model is part of the workflow decision: it determines where the artifact is managed and how the team handles access and change control.
Build a model in a reviewable sequence
- Open a sample model. Use it to learn the interface and see how diagram elements and threats are represented. It is an orientation aid, not a substitute for mapping your own system.
- Inspect the model metadata and data-flow diagram. Identify the system’s purpose, the components shown, and the flows between them. Check that the diagram reflects the architecture the team intends to analyze.
- Review components and their associated threats. Use the diagram to establish context, then inspect what has already been recorded for each element.
- Add, remove, or edit diagram elements. Adjust components and their properties so the model represents the system in scope rather than an example or an outdated design.
- Record threats and mitigations. Use the selected categorization approach and rule-engine suggestions as aids. Have knowledgeable participants assess whether each item applies, what is missing, and whether the proposed mitigation addresses the concern.
- Generate a PDF when a printable record is useful. The documented report includes the diagram and associated threats. A report is documentation of the model, not compliance approval.
Select an approach that fits the review
OWASP lists STRIDE, LINDDUN, CIA, DIE, CIA-DIE, and PLOT4ai among the supported threat categorization or modeling approaches. Choose one in light of the system and the review objective; the available sources do not establish that one is universally better than another.
Whatever approach you use, review the diagram’s scope and assumptions, the trust boundaries and data flows, and the threats and mitigations with people who understand the system. A categorization scheme helps structure the conversation, but it cannot determine whether the diagram is accurate or whether every relevant risk has been considered.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Version and project status
The official documentation identifies version 2.6.2, while the repository distinguishes the older v1.x line from v2.x: v1.x is no longer actively maintained, and v2.x is a rewrite using Vue.js. The repository labels the project Production status and specifies the Apache 2.0 license. Because release information can change, check the official release page for the current release rather than relying on a version number copied into an older guide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Learn the broader practice
Threat Dragon documents and organizes a model; learning how to identify and reason about threats is a broader skill. Adam Shostack’s Threat Modeling: Designing for Security is background on threat modeling for software, services, and systems, not a Threat Dragon manual. Wiley lists the first edition as a 2014, 624-page softcover, ISBN 978-1-118-80999-0. Wiley book listing
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
