ThreatModeler Nexus

ThreatModeler Nexus is a platform for secure design and governed threat modeling across applications, cloud and hybrid architectures, devices, and operational technology. Its Secure Design Graph connects architecture, threats, controls, compliance requirements, and security decisions. System Mapping, Graph, and Reporting agents operate on this graph, with support for STRIDE, PASTA, and CSA MAESTRO for agentic systems. Findings map to more than 180 regulatory and security frameworks, including NIST, ISO 27001, PCI DSS, HIPAA, DORA, and the EU AI Act. A built-in MCP Server checks pull requests and commits against the current threat model and returns threats, requirements, and mitigations in developer workflows. Listed integrations span infrastructure tools, cloud providers, development platforms, ServiceNow, and ArmorCode. Customers can connect their own AI model, while a deterministic framework governs output. The product offers web, API, and self-hosted environments. Community Edition is free; a ThreatModeler license costs $4,000 a year on a 12-month contract, and additional AWS infrastructure costs may apply. Standard Support states a 99.5% monthly uptime commitment; Enterprise Support states 99.9%.

ThreatModeler Nexus ties threat modeling to architecture records, compliance mappings, and developer workflows. Its listed license has an annual cost and contract term, while Community Edition is available at no charge.

ThreatModeler Nexus is aimed at enterprise security, architecture, development, compliance, and risk teams working across large portfolios. Its methods, framework mappings, and developer workflow checks may suit organizations governing threat models alongside software changes.

ThreatModeler Nexus is a threat-modeling platform for organizations managing security across applications, cloud and hybrid environments, devices, and operational technology. It is best suited to enterprise teams that need architecture, compliance, and developer workflows connected to a shared security record. Its breadth is compelling for portfolio-wide governance, but the paid license carries a 12-month contract and additional AWS infrastructure costs may apply.

Overview

Nexus centers on the Secure Design Graph, a shared record connecting architectures with threats, controls, compliance requirements, and security decisions. That structure can help security, architecture, development, compliance, and risk teams coordinate work across large portfolios instead of treating each threat model as an isolated document. Smaller teams seeking only a lightweight modeling tool may not need that governance scope.

ThreatModeler was founded in 2010 and is headquartered in Jersey City, New Jersey. Nexus supports web and API access as well as self-hosted deployment. ThreatModeler lists ISO 27001:2022 and SOC 2 Type II certifications, and announced FedRAMP Moderate authorization for Nexus in September 2026.

Key features

Modeling and prioritization

Nexus supports STRIDE, PASTA, and CSA MAESTRO for agentic systems, along with multiple modeling methods, templates, and frameworks. Attack-path analysis and risk prioritization help teams move beyond documenting threats to organizing which ones warrant attention. The Secure Design Graph includes more than 1,500 catalogued threats and more than 3,500 security requirements, giving teams a substantial library to draw on.

Compliance and developer workflow

The platform maps findings to more than 180 regulatory and security frameworks, including NIST, ISO 27001, PCI DSS, HIPAA, DORA, and the EU AI Act. Its built-in MCP Server checks pull requests and commits against the current threat model, returning threats, requirements, and mitigations within developer workflows. That connection is useful where teams want design decisions to inform code changes, though it serves a more integrated process than standalone modeling.

Integrations include HashiCorp Terraform, AWS CloudFormation, Azure ARM Templates, GitHub Actions, Azure DevOps, Jenkins, AWS, Google Cloud, Microsoft Azure, Bitbucket, ServiceNow, and ArmorCode. Customers can connect their own AI model; the deterministic framework governs its output. System Mapping, Graph, and Reporting agents operate on the Secure Design Graph, tying automation to the same system of record.

Pricing

Community Edition costs nothing and is aimed at practitioners, students, developers, architects, and security teams who want to experience threat modeling before scaling. It gives individuals and teams a no-cost starting point, but the plan information does not state its usage caps or collaboration limits.

The ThreatModeler license costs $4,000 a year, billed as a 12-month contract, with a single LICENSE dimension. Additional AWS infrastructure costs may apply. This is the paid option for organizations adopting Nexus as a governed platform; buyers should account for the contract term and infrastructure expense, while the single LICENSE dimension does not describe seat counts. Pricing for any other arrangement is custom pricing.

Standard Support commits to 99.5% monthly uptime; Enterprise Support commits to 99.9%. Support covers only the current major product version and the immediately preceding major version, so teams need to keep upgrades within that window to remain covered.

Platforms

Nexus supports API and web access, with self-hosted deployment also available. That combination suits organizations that need integration options or control over deployment, while buyers should assess their infrastructure needs alongside the possibility of additional AWS costs.

Who it's for

Nexus is the stronger fit for enterprise security, architecture, development, compliance, and risk teams overseeing large application and infrastructure portfolios. Its linked design graph, framework mappings, and pull-request checks are most useful when threat modeling needs to influence governance and delivery together. A practitioner exploring threat modeling or a small project without those cross-team needs may be better served by a simpler free tool.

Pros and cons

Pros

• A shared Secure Design Graph connects architectures, threats, controls, compliance requirements, and security decisions across a portfolio.
• More than 180 framework mappings and an MCP Server that checks commits and pull requests bring compliance and threat context into developer work.
• API, web, and self-hosted options, plus integrations across cloud, infrastructure-as-code, CI, and service-management tools, support varied enterprise workflows.
• Community Edition provides a no-cost way for individuals and teams to begin with threat modeling.

Cons

• The paid license requires a 12-month contract at $4,000 a year, with possible additional AWS infrastructure costs.
• The single LICENSE dimension does not establish how many seats are included, making it harder to map the stated price to team size.
• Support's version coverage is limited to the current and immediately preceding major release.
• The platform's portfolio governance focus may be more than a small team or individual needs.

Alternatives

For a broader comparison, see Threat Modeling Software.

• IriusRisk is worth considering for teams that want a freemium option with a free Community Edition capped at three active threat models and one user with limited collaboration.
• ThreatOpus may fit teams looking for a freemium service with a free trial and a Starter plan at £129.99 a month, billed £129.99/month, for 15 users and 50 threat-modelling generations monthly.
• ThreatTree offers a free tier capped at three forests, three DFDs per forest, and five Attack Trees per DFD; its Pro plan costs $29 a month, billed per user, monthly.
• CAIRIS is a free option available under the Apache Software License, with API, desktop, self-hosted, and web platforms.
• OWASP Threat Dragon is a free, open-source option with no paid plans or usage limits stated and support for desktop, self-hosted, and web use.
• ThreatForge is free and open source under Apache 2.0, requires no account, and makes its full application available to everyone.
• ADTool is a free option.
• AWS Threat Composer is a free option available across API, extension, desktop, self-hosted, and web platforms.

Verdict

ThreatModeler Nexus is a strong choice for enterprise teams that need threat models tied to architecture records, compliance mappings, and developer workflows. Its shared graph and extensive framework coverage give it a clear role in portfolio governance; the 12-month paid commitment and possible AWS costs are reasons to look elsewhere if a smaller, free tool will meet the need.