ThreatTree

ThreatTree is a browser-based threat-modeling tool that organizes work into forests containing Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then produces a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK; mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. Invited collaborators can have owner, editor, or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan, including Free. ThreatTree says data is stored on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are taken daily and kept for 30 days. Free costs nothing and has limits of three forests, three DFDs per forest, and five Attack Trees per DFD. Pro costs $29 a month, billed per user monthly. Enterprise pricing is by quote. ThreatTree says it is not currently SOC 2 or ISO 27001 certified.

ThreatTree combines structured threat modeling, risk prioritization, and exports, with a free tier and per-user Pro plan. Note its stated certification status and the Free plan’s forest and tree limits.

ThreatTree is for security teams, from solo consultants to CISO organizations, that need to model and prioritize risks. Its collaboration roles and framework tagging may suit teams reviewing threats together.

ThreatTree is a browser-based threat-modeling service for security teams that need diagrams, attack paths, and prioritized risk decisions in one workspace. It fits solo consultants through CISO-led groups that accept cloud deployment and want structured collaboration. Choose it for its connected modeling and reporting workflow; organizations requiring current SOC 2 or ISO 27001 certification should consider another platform.

Overview

ThreatTree arranges threat models into forests, each containing Data Flow Diagrams and Attack Trees. Likelihood-by-impact scoring automatically creates a ranked risk register across the trees in a forest. That cross-model view is useful when a program has several related systems and needs a single order of work, rather than disconnected diagram reviews.

Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK. Mitigations map to ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. The framework coverage helps standardize terminology and control discussions, but teams still have to validate whether a mapped control addresses their particular design.

Key features

Multiple modeling methods and attack-path analysis support both architectural review and examination of how threats can progress. PDF reports are suited to formal sharing, while JSON and STIX 2.1 exports provide structured ways to reuse model data in other workflows. Collaborative review is built around owner, editor, and viewer roles for invited members, so stakeholders can inspect models without automatically receiving edit rights.

Optional per-forest AES-256-GCM encryption is offered on every plan, including Free. ThreatTree says data resides on UK servers and connections use TLS 1.2 or higher. Encrypted database backups run daily, are retained for 30 days, and are stored separately from the primary store. Those measures address common operational concerns, while the service says it is not currently SOC 2 or ISO 27001 certified and has formal certification on its roadmap.

Pricing

Free

The Free plan costs nothing and has no trial because it is the ongoing free tier. It allows up to three forests, three DFDs per forest, and five Attack Trees per DFD. Encryption remains available, making this a sensible starting point for an individual or a small proof of concept. The forest and diagram ceilings will quickly constrain a larger program, and there is no published allowance for unlimited collaboration or full report generation.

Pro

Pro costs $29 a month per user, billed monthly. It removes the forest and tree limits, adds team collaboration and full report generation, and includes priority support. This is the practical choice for a growing security team that needs shared ownership and unrestricted model growth. Per-user billing means costs rise with every collaborator, so occasional reviewers may be better kept on the limited Free setup if their access needs are small.

Enterprise

Enterprise uses custom pricing, billed by quote on request according to organization size and requirements. It adds SSO/SAML, custom roles and data retention, multi-organization management, custom integrations, and a dedicated or VPC deployment option, plus dedicated support and an SLA. Enterprise integrations include custom Jira and ServiceNow ticketing, Terraform/OpenAPI architecture import, Splunk and Microsoft Sentinel feeds, GRC synchronization, and Confluence or Notion embeds. These capabilities target organizations with governance, deployment, and workflow-integration requirements that Pro does not address.

Platforms

ThreatTree is delivered as a cloud service through the web, with an API for programmatic access. It is not presented as a self-hosted product, so teams with strict infrastructure residency or on-premises mandates should evaluate alternatives.

Who it's for

Solo consultants can use Free to keep a small set of models and produce a structured risk view. Pro suits security teams conducting recurring collaborative reviews across many systems. Enterprise is aimed at CISO organizations that need identity federation, custom governance, integrations, or dedicated deployment and support. Cloud-only operation and the absence of current SOC 2 or ISO 27001 certification make it a poor fit for buyers whose procurement rules require either condition.

Pros and cons

Pros

• Connected prioritization: likelihood-by-impact scoring ranks risks across a forest, helping teams decide what to fix first.
• Broad standards vocabulary: threat tags and mitigation mappings cover major security and compliance frameworks.
• Useful interchange: PDF, JSON, and STIX 2.1 outputs support both human review and downstream tooling.
• Granular access: owner, editor, and viewer roles separate maintenance from read-only participation.
• Encryption on Free: optional AES-256-GCM protection is not reserved for paid tiers.

Cons

• Free caps: three forests, three DFDs per forest, and five Attack Trees per DFD limit sustained programs.
• Per-user Pro billing: monthly charges increase with each team member.
• Certification gap: ThreatTree is not currently SOC 2 or ISO 27001 certified.
• Cloud dependency: teams seeking self-hosting or local deployment need another product.

Alternatives

IriusRisk is a better fit when a free community edition with three active threat models, templates, and XML diagram export is enough, or when self-hosted deployment matters.

ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects, and security teams who want to try threat modeling before scaling.

ThreatOpus suits teams wanting a free trial and a paid Starter plan with 15 users, ten workspaces, and 50 threat-modeling generations per month.

CAIRIS is the straightforward choice for a freely available Apache-licensed tool across desktop and web platforms.

Dethernety fits buyers who prefer an open-source, self-hosted platform with their own graph database.

OWASP Threat Dragon is a free, open-source option with no paid plans or stated usage limits.

pytm is a free open-source alternative from the OWASP ecosystem.

Threagile provides a free MIT-licensed open-source toolkit for teams wanting that distribution model.

Verdict

ThreatTree is a strong choice for security practitioners and teams that want diagrams, attack-path analysis, ranked risks, framework mappings, and exports in one cloud workspace. Pro is the sensible tier once collaboration and model volume exceed Free’s caps. Look elsewhere if self-hosting, current SOC 2 or ISO 27001 certification, or a non-per-user commercial model is a hard requirement.