ThreatOpus

ThreatOpus combines threat modelling with pull request security checks that return PASS, WARN or FAIL decisions in CI pipelines. Teams can describe a system, import architecture from OpenAPI or Terraform, or link a GitHub repository to generate STRIDE threats and track mitigations. STRIDE is available on every plan, while Pro adds nine additional modelling frameworks. Merge Guard evaluates pull requests against policy bundles and posts decisions with reasons to CI checks. Listed integrations include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild and Travis CI; outcome notifications can go to Slack and Microsoft Teams. Scoped API keys are available for custom pipeline steps or internal orchestration. Project controls let users choose whether raw architecture input is stored, set its retention period and decide whether structured threat output remains after raw input expires. Signed-in users can export their data as JSON and delete content they created. ThreatOpus offers a free plan and trial, with paid plans starting at £129.99/mo. The company says generated threats and mitigations support security work but do not replace professional assessment, penetration testing or formal risk acceptance.

ThreatOpus links threat modelling to CI pull request decisions, with configurable data retention and multiple integrations. Its assessment limitation matters: generated results support security work but are not a substitute for professional review.

ThreatOpus is intended for security teams, security champions and platform engineers who want governed threat models and clear merge decisions. It can also suit teams that need configurable retention controls and CI integrations.

ThreatOpus connects threat modelling to pull-request security decisions for security teams, security champions, and platform engineers. It is most compelling when teams want policy checks in CI; generated analysis remains support for, not a replacement for, expert assessment.

Overview

Teams can describe a system, import OpenAPI or Terraform, or link a GitHub repository to generate STRIDE threats and track mitigations. Merge Guard checks pull requests against policy bundles and posts a PASS, WARN, or FAIL result, including reasons, to CI checks. That puts a clear security decision closer to the change being reviewed, rather than leaving threat models as a separate exercise.

Attack-path analysis, risk prioritization, collaborative review, templates, and multiple modelling methods extend the product beyond basic threat diagrams. Still, generated threats and mitigations do not replace professional assessment, penetration testing, or formal risk acceptance. Teams should treat the output as an input to security work, not its final authority.

Key features

Models connected to pull requests

Import paths from OpenAPI and Terraform, system descriptions, and GitHub repositories give teams several ways to start modelling. Tracking mitigations alongside policy-based pull-request checks makes ThreatOpus a stronger fit for teams that want security review tied to delivery. It is less compelling for buyers who need only a standalone modelling workspace without CI decisions.

Frameworks and integrations

STRIDE is available on every plan; Pro adds nine more threat-modelling frameworks. That makes the lower tiers workable for teams whose needs fit STRIDE, while teams requiring broader methodology choice must budget for Pro. Source control and CI integrations include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI. Slack and Microsoft Teams notifications carry check outcomes, and scoped API keys support custom pipeline steps or internal orchestration.

Data and account controls

Project settings let teams choose whether raw architecture input is stored, how long it is retained, and whether structured threat output remains after that input expires. Signed-in users can export their data as JSON and delete content they created. Accounts use email verification and password policies, sessions use httpOnly cookies, and optional two-factor authentication is available. ThreatOpus says it does not sell personal data; customers can request a subprocessor list for security review. These controls give teams useful choices over project data, though they do not remove the need to assess the product against internal security requirements.

Pricing

ThreatOpus has a free plan and paid plans billed monthly. Free is a small-scale starting point; Starter costs £129.99/month, Pro £299.99/month, and Enterprise has custom pricing. A free trial is available.

Free is best for a small team validating a limited workflow: its three-user, one-repository cap and five monthly generations will constrain sustained use. Starter raises those ceilings and includes all SCM and CI providers, but remains limited to STRIDE and email support. Pro is the tier for larger teams that need more capacity, extra frameworks, consultation, or priority support. Enterprise suits organizations that need custom scale, unlimited workspaces and generations, or SSO. The paid monthly prices are explicit; Enterprise is custom-priced.

Platforms

ThreatOpus supports web and API access. Its range of SCM and CI integrations makes it relevant to teams working across the named providers, while API keys support custom pipeline integration.

Who it's for

Security teams, security champions, and platform engineers seeking governed threat models and clear merge decisions are the natural audience. Teams that want PR checks to reflect security policy can use the modelling and Merge Guard workflow together. It is a weaker fit for organizations expecting automated findings to stand in for expert review, or for users who need more than STRIDE but cannot justify Pro.

Pros and cons

• Pro: Merge Guard returns reasoned PASS, WARN, or FAIL outcomes in CI, giving reviewers a concrete decision point before merge.
• Pro: OpenAPI, Terraform, system descriptions, and GitHub repositories provide multiple routes into threat modelling.
• Pro: Retention choices, JSON export, and user-controlled deletion support practical data governance.
• Con: Free caps usage at five generations per month, one repository, one workspace, and three users, limiting it to modest evaluation or small teams.
• Con: Nine additional frameworks are reserved for Pro, so teams needing methodology breadth face a substantial step up from Starter.
• Con: Generated results require professional judgment and cannot replace assessment, penetration testing, or formal risk acceptance.

Alternatives

For a broader comparison, see Threat Modeling Software. Choose IriusRisk if its free Community Edition's three active threat models, limited one-user collaboration, templates and libraries, and XML diagram export suit a smaller or individual workflow. ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects, and security teams to try threat modelling before scaling. Choose ThreatTree if its free tier of up to three forests, three DFDs per forest, and five attack trees per DFD fits the work, or if its Pro plan at $29 a month, billed per user monthly, better matches the budget.

CAIRIS is a free option available across API, desktop, self-hosted, and web platforms. Dethernety offers a free open-source, self-hosted platform with a bring-your-own graph database model. OWASP Threat Dragon is a free, open-source option with no paid plans or usage limits stated. pytm is a free option for Linux, macOS, and Windows. Threagile is a free, MIT-licensed open-source toolkit.

Verdict

Choose ThreatOpus if your team wants threat models to inform governed pull-request decisions and needs integrations plus retention controls around that workflow. Its clearest advantage is the connection between modelling and CI outcomes; look elsewhere if you need automated results to replace expert assessment, or broader frameworks without moving to Pro.