- Home
- Threat Modeling Software
- AWS Threat Composer
AWS Threat Composer
What it is
AWS Threat Composer is a threat-modeling project that helps users identify security issues and plan ways to address them. Its structured threat grammar provides adaptive suggestions as users write threat statements. A model can include architecture and data-flow diagrams, tracked assumptions, links between threats and mitigations, and an insights dashboard with quality measures and improvement suggestions. Users can manage multiple models and export them as JSON, Markdown, DOCX, or PDF. The web application stores data in the browser and supports import and export; it is available as a hosted demo or as a static site users can deploy to an AWS account. A VS Code extension included in AWS Toolkit edits .tc.json files, works offline, and stores data in local files. A browser extension can display threat model files on GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst, including configured self-hosted instances. That extension is read-only and requires internet access to load web files. The experimental AI-assisted CLI and MCP server can analyze source code to create starter threat models; AWS Bedrock inference costs apply to those AI tools.
For and against
For
- Includes architecture and data-flow diagrams
- Links threats with mitigations
- Exports models in four formats
- VS Code extension works offline
- Web app supports import and export
Against
- AI CLI and MCP server are experimental
- AI tools incur AWS Bedrock inference costs
- Browser extension is read-only
- Browser extension needs internet access for web files
The verdict
Threat Composer offers several ways to create and review threat models, from a browser-based app to a local VS Code workflow. Check the read-only browser extension and experimental, chargeable AI tools against your intended workflow.
Who it suits
Threat Composer suits people modeling system threats, including developers who want to keep models alongside code in version control. Its different web, VS Code, and browser-extension options support distinct workflows, with different storage and access constraints.
On the record
- AI cost
- The project page says AWS Bedrock inference costs apply to the AI-powered CLI and MCP server.github.com · read 2 Oct 2026
- AI tools
- The AI-assisted CLI analyzes codebases to generate starter threat models, and the MCP server supports workflow management and schema validation for AI assistants.github.com · read 3 Oct 2026
- AI usage costs
- The AI CLI and MCP server use AWS Bedrock, and Bedrock inference costs apply.github.com · read 3 Oct 2026
- Audience and workflow
- The project is designed for people threat modeling systems, and its VS Code integration supports keeping threat models alongside code in version control.github.com · read 2 Oct 2026
- Browser extension integrations
- The browser extension supports GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst, including configurable URL patterns for self-hosted instances.github.com · read 2 Oct 2026
- Browser extension limitation
- The browser extension provides read-only viewing, requires internet access to load web-hosted files, and may take time to load large models.github.com · read 3 Oct 2026
- Browser extension limits
- The browser extension is read-only, requires internet access to load web files, and its documentation says Chrome Web Store and Firefox Add-ons publication is not yet available.github.com · read 2 Oct 2026
- Browser extension privacy
- The browser extension documentation says it does not collect or transmit data, uses no analytics or tracking, and handles viewing locally in the browser.github.com · read 3 Oct 2026
- Browser integrations
- The browser extension supports viewing threat model files on GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst; its documentation says Chrome Web Store and Firefox Add-ons publication is not yet available.github.com · read 3 Oct 2026
- Diagrams and insights
- Features include architecture and data flow diagrams, plus an insights dashboard with quality metrics and improvement suggestions.github.com · read 3 Oct 2026
- Exports
- Threat models can be exported in JSON, Markdown, DOCX, and PDF formats.github.com · read 2 Oct 2026
- Modeling features
- It supports architecture and data flow diagrams, assumptions tracking, threat and mitigation links, and an insights dashboard.github.com · read 2 Oct 2026
- Model management
- Users can track assumptions, link them to threats and mitigations, manage multiple models, and export models as JSON, Markdown, DOCX, or PDF.github.com · read 3 Oct 2026
- Purpose
- Threat Composer is a threat modeling ecosystem for identifying security issues and developing strategies to address them in the context of a system.github.com · read 3 Oct 2026
- Self-hosting
- The web application can be deployed to an AWS account with customization.github.com · read 2 Oct 2026
- Support
- The project directs users to GitHub Issues and GitHub Discussions for bug reports, feature requests, and questions.github.com · read 2 Oct 2026
- Support and security reports
- The project directs users to GitHub Issues and Discussions for feedback and support, and asks that security vulnerabilities be reported through AWS's Vulnerability Disclosure Program or [email protected].github.com · read 3 Oct 2026
- Threat statements
- It uses structured threat grammar with adaptive suggestions to help users compose threat statements.github.com · read 3 Oct 2026
