- Home
- Threat Modeling Software
- Dethernety
Dethernety
What it is
Dethernety is an open-source platform for building and analyzing threat models as architecture graphs. Teams can create and explore models in a browser, from code, or from reports. Its analysis uses the architecture graph to identify attack paths, assess blast radius, and examine residual risk. Exposures map to MITRE ATT&CK techniques, while controls map to D3FEND countermeasures for coverage gap analysis. JavaScript and TypeScript modules support design, analysis, and issues, alongside an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation issues in both directions. Users host their own graph database; Neo4j and Memgraph are named options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on infrastructure users control and can operate fully offline without cloud calls. The maker says there is no background telemetry or usage data. Open Source is listed as free; Enterprise is self-hosted with custom terms and dedicated support, with price not listed.
For and against
For
- Models can be built visually, from code, or from reports.
- Analysis covers attack paths, blast radius, and residual risk.
- Exposures and controls map to named threat frameworks.
- The open-source edition can operate fully offline.
- Issue modules can sync remediation with external trackers.
Against
- Users must host their own graph database.
- Hosted SaaS is planned for later.
- BYODt and BYODt Team are coming soon.
The verdict
Dethernety offers graph-based threat analysis in a self-hosted open-source edition, with modules and analysis options for different workflows. Its self-hosting and database requirements are important considerations; Enterprise adds dedicated support and deployment help.
Who it suits
The browser interface is described for security teams, while the CLI supports DevOps teams, CI/CD automation, and threat-model-as-code. It suits users prepared to host their own graph database and infrastructure.
Plans and prices
Open Source
Full platform · self-hosted · bring your own graph database · offline-capable
Read 15 Oct 2026 · dether.net
BYODt
Self-hosted · cloud-served specialized modules · closed-vocabulary attributes only leave your network
Read 15 Oct 2026 · dether.net
BYODt Team — 5 or 20 seats
5 or 20 seats · self-hosted · shared package access
Read 15 Oct 2026 · dether.net
Enterprise
Self-hosted · own identity provider · air-gap-friendly · dedicated support
Read 15 Oct 2026 · dether.net
Hosted SaaS
Per-customer isolated managed deployment · separate network, identity, storage and compute
Read 15 Oct 2026 · dether.net
On the record
- AI analysis
- Analysis options include deterministic queries, single-agent AI acceleration, and multi-agent LangGraph workflows.dether.net · read 8 Oct 2026
- Analysis engines
- Analysis can use deterministic queries, single-agent AI acceleration or multi-agent LangGraph workflows.dether.net · read 15 Oct 2026
- Availability limits
- BYODt and BYODt Team are described as coming soon, while Hosted SaaS is planned for later; package composition and pricing are still being finalized.dether.net · read 8 Oct 2026
- Claude Code integration
- The Dethereal Claude Code plugin provides 14 slash commands, 5 specialized agents and 22 MCP tools.github.com · read 15 Oct 2026
- CLI workflow
- The CLI supports CI/CD automation and threat-model-as-code with version control.dether.net · read 15 Oct 2026
- Company founder
- Levente Simon is identified as Dethernety's founder and creator, with more than 25 years in strategy, leadership, architecture and software development.dether.net · read 15 Oct 2026
- Container quickstart
- The BYODt deployment requires Docker with Compose or Podman 4.1 or newer and runs from signed images.github.com · read 15 Oct 2026
- Data handling
- The maker says models, data, and findings stay on the user's infrastructure; optional cloud evaluations send only closed-vocabulary configuration attributes and discard the payloads.dether.net · read 8 Oct 2026
- Deployment prerequisites
- The documented source setup requires Node.js 18 or newer, pnpm 9.13 or newer, Neo4j or Memgraph and an OIDC provider.github.com · read 15 Oct 2026
- Deterministic analysis
- The platform computes exposures, controls and attack paths from the model and links findings to evidence.dether.net · read 15 Oct 2026
- Documentation
- The repository includes user guides, architecture documentation, configuration guidance, security-model documentation and module-development documentation.github.com · read 15 Oct 2026
- Evidence sources
- Module findings cite sources including CVE, NIST 800-53, CWE, CIS, MITRE ATT&CK and D3FEND.dether.net · read 15 Oct 2026
- File portability
- Models can be exported as JSON or split-file ZIPs, versioned with code, edited offline and re-imported.github.com · read 15 Oct 2026
- Graph databases
- The platform names Neo4j and Memgraph as graph database options, and users host their own graph database.dether.net · read 8 Oct 2026
- Graph queries
- Attack paths, blast radius and chokepoints are analyzed as graph operations rather than table joins.dether.net · read 15 Oct 2026
- Graph storage
- Models are stored as graph structures in Neo4j or Memgraph, with components, flows, boundaries and controls represented as nodes and relationships.github.com · read 15 Oct 2026
- Independent directory description
- Toreon describes Dethernety as a visual graph-native threat-modeling tool that analyzes architectural attack paths and produces MITRE-mapped findings.github.com · read 15 Oct 2026
- Independent directory listing
- Toreon's threat-modeling directory lists Dethernety as a 2026 personal release by Velnomix, active, AI-capable and AGPL-3.0-only.github.com · read 15 Oct 2026
