Best Threat Modeling Software in 2026
Updated
In short: IriusRisk is ranked #1 of 22 as of 4 October 2026, ahead of ThreatModeler Nexus and ThreatOpus. The best-ranked option with a free plan is ThreatModeler Nexus. The lowest first paid tier on this page is ThreatZ at $8.33/mo.
Threat modeling software supports the work of identifying and organizing security risks as systems are designed and reviewed. Compare modeling methods, attack-path analysis, and risk prioritization to see how each option represents threats and helps direct attention. Templates and frameworks, collaborative review, and deployment are also useful points to weigh, alongside project limits, free-plan availability, and paid-from pricing. The ranking starts with AWS Threat Composer and IriusRisk, with ThreatModeler Nexus, ThreatOpus, and ThreatTree following among the first entries. CAIRIS, OWASP Threat Dragon, and ADTool are also near the top. Consider which modeling approach and review setup fit your work, then compare the listed capabilities and limits.
22 threat modeling software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score
- 1 IriusRisk No phone app RecognisedPhone appDocumentedFree plan 6.4Free Risk prioritization: Yes
- 2 ThreatModeler Nexus No phone app RecognisedPhone appDocumentedFree plan 6.4$333.33/mo Attack-path analysis: YesRisk prioritization: Yes
- 3 ThreatOpus No phone app RecognisedPhone appDocumentedFree plan 6.4£129.99/mo Attack-path analysis: YesRisk prioritization: Yes
- 4 ThreatTree No phone app RecognisedPhone appDocumentedFree plan 6.4$29/mo Attack-path analysis: YesRisk prioritization: Yes
- 5 CAIRIS No phone app RecognisedPhone appDocumentedFree plan 6.3Free Attack-path analysis: YesRisk prioritization: Yes
- 6 OWASP Threat Dragon No phone app RecognisedPhone appDocumentedFree plan 6.3Free Risk prioritization: Yes
- 7 AWS Threat Composer No phone app RecognisedPhone appDocumentedFree plan 5.9 Risk prioritization: Yes
- 8 CYMETRIS No phone app RecognisedPhone appDocumentedFree plan 5.6€99/mo Project limit: 5 projectsAttack-path analysis: YesRisk prioritization: Yes
- 9 ADTool No phone app RecognisedPhone appDocumentedFree plan 5.4 Attack-path analysis: YesRisk prioritization: Yes
- 10 itemis SECURE No phone app RecognisedPhone appDocumentedFree plan 5.4 Attack-path analysis: YesRisk prioritization: Yes
- 11 Dethernety No phone app RecognisedPhone appDocumentedFree plan 5.3 Attack-path analysis: YesRisk prioritization: Yes
- 12 EnCo SOX ATA No phone app RecognisedPhone appDocumentedFree plan 5.3 Attack-path analysis: YesRisk prioritization: Yes
- 13 Microsoft Threat Modeling Tool No phone app RecognisedPhone appDocumentedFree plan 5.3 Risk prioritization: Yes
- 14 AutoSec TARA Suite No phone app RecognisedPhone appDocumentedFree plan 5.2 Attack-path analysis: NoRisk prioritization: Yes
- 15 KAVACH No phone app RecognisedPhone appDocumentedFree plan 5.2 Attack-path analysis: YesRisk prioritization: Yes
- 16 pytm No phone app RecognisedPhone appDocumentedFree plan 5.2 Risk prioritization: Yes
- 17 SD Elements No phone app RecognisedPhone appDocumentedFree plan 5.2 Risk prioritization: Yes
- 18 Threagile No phone app RecognisedPhone appDocumentedFree plan 5.2
- 19 ThreatForge No phone app RecognisedPhone appDocumentedFree plan 5.2
- 20 ThreatZ No phone app RecognisedPhone appDocumentedFree plan 5.2$8.33/mo Project limit: 3 projectsAttack-path analysis: YesRisk prioritization: Yes
- 21 DevArmor No phone app RecognisedPhone appDocumentedFree plan 4.9
- 22 TSpec No phone app RecognisedPhone appDocumentedFree plan 4.9
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which threat modeling software is ranked first on Samsung Mobile US Press?
IriusRisk is ranked #1 of 22 with a score of 6.4. ThreatModeler Nexus is second and ThreatOpus third.
How many of these have a free plan?
6 of the 22 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, ThreatZ has the lowest first paid tier we found: $8.33/mo.
How is this list ranked?
Ranked mobile-first: a phone app alongside the web or desktop product, a free tier and the depth of its documentation. Paid placements never change a rank.