CAIRIS

Overview

CAIRIS brings assets, countermeasures, factoids, personas, requirements, and architectural components into a shared design model. That breadth is useful when teams need to consider security and usability alongside requirements, rather than treating threat analysis as a detached final check. It is a more structured choice than a diagram-only tool, so it fits best when a project will benefit from maintaining those relationships as it evolves.

The platform can generate 12 views across people, risks, requirements, architecture, and physical location. It can also produce threat models such as Data Flow Diagrams as the design develops. These outputs help teams examine a changing design from several angles, but their usefulness still depends on the model accurately reflecting the system.

Key features

Threat and security analysis

Multiple modeling methods, attack-path analysis, and risk prioritization support a connected review of a design. Attack and architectural patterns help assess attack surface and check for known security problems and potential GDPR compliance issues. This makes CAIRIS a good fit for teams bringing security decisions into architecture early; it is not a substitute for deciding whether the model or its findings are sound.

Requirements and documentation

CAIRIS generates Volere-compliant requirement specifications and GDPR DPIA documents. Teams that need these outputs alongside their security and usability models can keep related work together instead of assembling each document separately.

API and browser extension

The API can support custom design apps or integrate CAIRIS into an existing toolchain. The Persona Helper Chrome Extension turns highlighted web-page text into document references connected to a CAIRIS server, a focused aid for gathering material relevant to personas.

Pricing

CAIRIS is free: its Free plan costs 0.00 USD per free and is available under the Apache Software License. That makes it a practical option for teams able to deploy and manage open-source software without a recurring plan charge. No paid tier is needed to access the platform, but users should account for the work of installation and hosting.

The live demo is rebuilt nightly, and accounts other than its recreated test account are deleted each Sunday morning. All databases in the demo are visible to everyone. Treat it as a public demonstration, not a confidential workspace, and export models you want to retain.

Platforms

CAIRIS supports API, Linux, macOS, self-hosted, web, and Windows. It can be installed with Docker or Vagrant, or built from source on platforms supported by its open-source dependencies; Ubuntu is the most tested platform. The web app works in modern browsers other than Microsoft Internet Explorer, with Microsoft Edge supported. Teams choosing a less-tested installation platform should expect to work within the constraints of its dependencies.

Who it's for

CAIRIS is best suited to security, architecture, and requirements teams that want to connect user perspectives, system design, threat models, and formal documentation. Its API also makes it relevant to teams building an integrated toolchain. It is a weaker fit for someone seeking only a quick standalone diagram, or anyone who needs to keep project data in the public demo.

For support, users can raise a GitHub issue or contact the maker with problems or feature requests.

Pros and cons

• Pros: Security, usability, and requirements data share a model, helping teams examine design trade-offs together.
• Pros: Automated views, threat models, and formal specifications connect evolving design work to analysis and documentation.
• Pros: Free availability under the Apache Software License avoids a subscription cost.
• Cons: Deployment depends on open-source dependencies; Ubuntu is the most tested platform, so other setups may take more effort.
• Cons: Demo databases are public, and work can be lost in nightly rebuilds unless exported.
• Cons: Internet Explorer is not supported for the web application.

Alternatives

Threat Modeling Software is a broader category to browse when CAIRIS is not the right fit.

• IriusRisk is another free-plan option, with a Community Edition capped at three active threat models and one user with limited collaboration.
• ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects, and security teams to experience threat modeling before scaling.
• ThreatOpus may suit teams wanting a paid Starter plan with 15 users, 10 workspaces, and 50 threat-model generations per month; it costs 129.99 GBP per month.
• ThreatTree has a free plan capped at three forests, three DFDs per forest, and five Attack Trees per DFD, with Pro at 29.00 USD per month per user.
• CYMETRIS is a paid alternative starting with CYMETRIS Lite at 99.00 EUR per month, including one full TARA project.
• itemis SECURE is a paid web and Windows option with named-user or floating licensing.
• AWS Threat Composer is a free alternative.
• OWASP Threat Dragon is a free, open-source alternative with no paid plans or usage limits stated.

Verdict

Choose CAIRIS if your team wants a free, open-source workspace that ties requirements and user perspectives to threat analysis, security checks, and generated documentation. Its breadth and extensibility are compelling for design-led security work; look elsewhere if you need a simpler diagramming tool or a private, persistent hosted demo.