For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
Mobile US PressList your app
Vendor dashboard

OWASP Threat Dragon

No phone app

6.3No. 6 of 22
in Threat Modeling Software
  • Recognised40% of the score20
  • Phone app26% of the score0
  • Documented20% of the score89
  • Free plan14% of the score100
Free plan
Yes
Runs on
Linux, Mac, self-hosted, Web, Windows
Visit site Alternatives

Summary

OWASP Threat Dragon is ranked #6 of 22 in threat modeling software on Samsung Mobile US Press. It runs on Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

OWASP Threat Dragon plans and pricing

All plans
Free Free Free, open source No paid plans or usage limits stated owasp.org · 3 Oct 2026

Compared on threat modeling software

Free plan
Yesthreatdragon.com
Risk prioritization
Yesthreatdragon.com
Templates and frameworks
Yesthreatdragon.com
Modeling methods
multiplethreatdragon.com
Deployment
self_hostedthreatdragon.com

Facts

Purpose
Threat Dragon creates threat model diagrams and lists threats for diagram elements as part of a secure development lifecycle.owasp.org · 3 Oct 2026
Threat frameworks
It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories.threatdragon.com · 3 Oct 2026
Threat suggestions
A rule engine can suggest threats and mitigations, including context-specific suggestions based on diagram element properties.threatdragon.com · 3 Oct 2026
Diagrams
Diagrams can include processes, data stores, actors, data flows and trust boundaries.threatdragon.com · 3 Oct 2026
Storage and integrations
The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally.threatdragon.com · 3 Oct 2026
Desktop platforms
Desktop installers are provided for Windows, macOS and Linux.threatdragon.com · 3 Oct 2026
License
The OWASP project page lists the license as Apache License 2.0.owasp.org · 3 Oct 2026
Security practices
The project says its repository enforces signed commits, supply-chain actions use full-length SHAs, and desktop releases are signed and notarized where possible.threatdragon.com · 3 Oct 2026
Security testing
The project says automated dependency, SAST, DAST and container security scans run on every commit.threatdragon.com · 3 Oct 2026
Privacy
Analytics are disabled by default, require server configuration, and do not collect threat model content or usernames for Plausible.threatdragon.com · 3 Oct 2026
Support
The project directs users to its mailing list, OWASP Slack channel, GitHub issues and public discussions for questions, bugs and feature requests.owasp.org · 3 Oct 2026
Maintenance limitation
The project is maintained by volunteers and says immediate investigation or response to incidents is not always possible.threatdragon.com · 3 Oct 2026
Intended users
OWASP describes Threat Dragon as intended for developers and defenders, and says both experienced threat modelers and beginners can use it.owasp.org · 3 Oct 2026

Best OWASP Threat Dragon alternatives

See all 12
IriusRisk No. 1 6.4 No phone appFreeThreatModeler Nexus No. 2 6.4 No phone app$333.33/moThreatOpus No. 3 6.4 No phone app£129.99/moThreatTree No. 4 6.4 No phone app$29/moCAIRIS No. 5 6.3 No phone appFreeAWS Threat Composer No. 7 5.9 No phone app

Where it ranks on Samsung Mobile US Press

Is OWASP Threat Dragon yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP Threat Dragon

Sources