- Home
- Threat Modeling Software
- ThreatForge
ThreatForge
What it is
ThreatForge is a free, open-source desktop app for creating threat models with visual diagrams, automated STRIDE analysis and AI-assisted discovery. Its drag-and-drop canvas has 44 typed components in 10 categories, with trust boundaries, text annotations and automatically routed connections. A built-in rules engine produces threats from component types and data-flow patterns and works offline. The app can connect a model discussion with Claude or GPT to suggest threats, propose mitigations and answer security questions; this uses your own API key. Models are human-readable YAML files that can be versioned and reviewed in pull requests. Six templates cover cloud microservices, e-commerce, mobile banking, SaaS, IoT smart buildings and healthcare systems. The maker says there is no telemetry and models stay on the user's machine. No account is required. The full application is available for free under Apache 2.0, without freemium upsells or enterprise-only features. ThreatForge supports Linux, macOS, Windows and web; the maker describes its download as approximately 10 MB. It is positioned for developers and teams seeking threat modeling without an enterprise procurement cycle.
For and against
For
- Offline STRIDE analysis uses a built-in rules engine.
- No account is required to get started.
- Models use human-readable YAML.
- Six templates cover varied system types.
- Apache 2.0 license; no enterprise-only features.
Against
- AI assistance uses your own API key.
- The maker describes the download as approximately 10 MB.
The verdict
ThreatForge combines diagramming, rule-based STRIDE analysis and optional AI assistance in a free, open-source app. Its offline analysis and versionable YAML models may suit teams seeking a developer-oriented workflow.
Who it suits
ThreatForge suits developers and teams who want visual threat modeling, offline STRIDE analysis and YAML files that can be tracked over time. AI assistance requires users to bring their own API key.
Plans and prices
Threat Forge
Free and open source under Apache 2.0 · no account required · full application available to everyone
Read 7 Oct 2026 · exitzerolabs.com
On the record
- Account
- No account is required to get started.exitzerolabs.com · read 7 Oct 2026
- AI analysis
- The app supports chatting with Claude or GPT about a threat model and can suggest threats, propose mitigations, and answer security questions; it uses BYOK.exitzerolabs.com · read 7 Oct 2026
- Diagrams
- Its drag-and-drop canvas has 44 typed components across 10 categories, with trust boundaries, text annotations, and automatically routed connections.exitzerolabs.com · read 7 Oct 2026
- Download size
- The maker describes the download as approximately 10 MB.exitzerolabs.com · read 7 Oct 2026
- File format
- Threat models use human-readable, git-diffable YAML files that can be reviewed in pull requests and versioned over time.exitzerolabs.com · read 7 Oct 2026
- Intended users
- The maker positions Threat Forge as a developer-friendly alternative for teams seeking threat modeling without an enterprise procurement cycle.exitzerolabs.com · read 7 Oct 2026
- License
- The application is released under the Apache 2.0 license, with no freemium upsells or enterprise-only features.exitzerolabs.com · read 7 Oct 2026
- Privacy
- The maker says there is no telemetry and threat models stay on the user's machine.exitzerolabs.com · read 7 Oct 2026
- Product
- Threat Forge is an open-source desktop app for threat modeling with visual diagrams, automated STRIDE analysis, and AI-assisted threat discovery.exitzerolabs.com · read 7 Oct 2026
- STRIDE
- The built-in rule engine generates threats from element types and data-flow patterns and works fully offline.exitzerolabs.com · read 7 Oct 2026
- Templates
- Six templates cover Cloud Microservices, E-Commerce, Mobile Banking, SaaS Platform, IoT Smart Building, and Healthcare System.exitzerolabs.com · read 7 Oct 2026
