IriusRisk

IriusRisk is an AI threat modeling tool for secure software design. It helps teams create threat models, identify threats and countermeasures, and review vulnerabilities and compliance gaps. Its Jeff AI Assistant can use user stories, documentation, meeting transcripts, or code to produce a threat model diagram showing threats and security controls. A built-in knowledge base supports standards such as PCI DSS, NIST, and GDPR, marking aligned countermeasures as required. Listed integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and Open API. Users can import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool. The free Community Edition is for one user and allows three active threat models, with limited collaboration, templates and libraries, XML diagram export, and technical and compliance reports. Enterprise is available as SaaS or on-premise, with no price listed. IriusRisk says its cloud services are not designed or certified for processing PHI, specially treated financial data, IDs, or GDPR special category data.

IriusRisk supports threat modeling with AI-assisted diagram generation, standards guidance, and integrations. The free edition has a small user and model limit, and its cloud service is not designed for several categories of sensitive data.

IriusRisk is aimed at security teams, developers, CISOs, and compliance teams working on secure software design and threat modeling.

IriusRisk is threat-modeling software for teams designing secure applications. It is best suited to security, development, and compliance groups that want risk analysis tied to standards and engineering workflows. Its free edition is useful for an individual’s small set of models, but teams must move to Enterprise for unlimited users and models, and some sensitive data is excluded from its cloud service.

Overview

IriusRisk helps teams build threat models, identify threats and countermeasures, and surface vulnerabilities and compliance gaps. Risk prioritization, collaborative review, multiple modeling methods, and templates give the work structure beyond drawing a diagram. That makes it a focused option for software security design rather than simply a place to sketch system architecture.

Jeff AI Assistant can turn user stories, documentation, meeting transcripts, or code into a diagram containing threats and security controls. Using existing project materials as a starting point can reduce the work of assembling a model, while the resulting threats and controls still need review by people who understand the design.

Key features

Standards and controls

The built-in knowledge base supports applying PCI DSS, NIST, and GDPR to threat models, with aligned countermeasures marked as required. This helps teams bring those frameworks into modeling, but it is not a substitute for determining whether a model and its controls meet their broader compliance obligations.

Engineering workflow

Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and an Open API. That range connects threat modeling with project management, development, and security tools. Users can also import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool, which can ease a move from an existing diagramming workflow.

Security and data boundaries

IriusRisk says it holds ISO/IEC 27001 certification and maintains independently audited controls. Its stated measures include encryption in transit and at rest, access controls, regular penetration testing, and incident response procedures. Those safeguards do not change the cloud service’s stated boundary: it is not designed or certified for PHI, specially treated financial data, IDs, or GDPR special category data. Organizations handling those categories should assess the on-premise Enterprise option rather than assume the cloud service is suitable.

Pricing

IriusRisk uses a freemium model. The Community Edition costs free and includes three active threat models, one user with limited collaboration, templates and libraries, XML diagram export, and technical and compliance reports. It is a practical starting point for an individual, but the three-model ceiling and single-user access make it a poor fit for a team or a broad modeling program.

Enterprise has custom pricing and is offered as SaaS or on-premise. It includes purchased threat models with no maximum, unlimited users, configurability, OpenAPI, a dedicated Customer Success Manager, and enterprise onboarding. This is the plan for organizations that need team-wide use, more capacity, or an on-premise deployment; its price is not published. IriusRisk offers no free trial. Standard, Gold, and Platinum support plans vary in availability, response times, and channels.

Platforms

IriusRisk supports API access, self-hosted deployment, and web use. Enterprise is specifically offered as SaaS or on-premise, giving organizations a choice of cloud or on-premise deployment. That flexibility is relevant for teams assessing data handling requirements, but the stated sensitive-data exclusions still apply to its cloud service.

Who it's for

Security teams, developers, CISOs, and compliance teams are the intended audience. It suits organizations that need threat modeling to connect with engineering workflows and standards guidance, especially when several people must review risks together. Individuals can use the Community Edition to model a few systems; teams that need shared access or more than three active models will need Enterprise. Cloud service is not the right choice for organizations whose work requires processing the sensitive data categories IriusRisk excludes.

Pros and cons

• Pros: AI can generate a threat-model diagram from several kinds of project material, giving teams a starting point that includes threats and controls.
• Pros: Standards guidance, risk prioritization, collaborative review, integrations, and diagram imports support a workflow that spans modeling and engineering tools.
• Pros: Enterprise supports unlimited users and models and can be deployed on-premise or as SaaS.
• Cons: Community Edition is limited to one user and three active models, restricting its usefulness for collaborative or larger-scale work.
• Cons: The cloud service is not designed or certified for several sensitive data categories, narrowing its suitability for some organizations.
• Cons: Enterprise uses custom pricing, and there is no free trial for evaluating the paid plan.

Alternatives

Choose Threat Modeling Software to compare the category. ThreatModeler Nexus has a free Community Edition aimed at practitioners, students, developers, architects, and security teams who want to experience threat modeling before scaling. ThreatOpus is worth considering for teams wanting a free plan and trial, or a paid Starter plan at £129.99 a month with 15 users, 10 workspaces, and 50 generations per month. ThreatTree offers a free tier capped at three forests, three DFDs per forest, and five Attack Trees per DFD, with a Pro option at $29 a month billed per user monthly. CAIRIS is a free option distributed under the Apache Software License. Dethernety offers a free, self-hosted open-source platform that uses a user-provided graph database. OWASP Threat Dragon is a free open-source alternative with no paid plans or usage limits stated. pytm is a free option from OWASP, a nonprofit foundation focused on software security through open-source collaboration, education, and innovation. Threagile is a free open-source toolkit under the MIT License.

Verdict

IriusRisk is a strong fit for security and engineering teams that want threat modeling connected to standards, project materials, and development tools. Its AI-assisted model generation and Enterprise capacity are compelling for collaborative work; choose another option if the single-user Community Edition is too restrictive, custom Enterprise pricing is a barrier, or your cloud deployment must process excluded sensitive data.