The browser interface is described for security teams, while the CLI supports DevOps teams, CI/CD automation, and threat-model-as-code.
Free plan Free trial Open source WebAPISelf-hosted
- Home
- Developer Tools
- Threat Modeling Software
Best Threat Modeling Software 2026
Facts read 22 Sep 2026 – 15 Oct 2026
For teams assessing security risks in a system, threat modeling software can help structure the process of identifying and reviewing potential threats. Compared on modeling methods, attack-path analysis, templates and frameworks, and risk prioritization, the entries also vary in collaborative review and deployment. Project limits, free-plan availability, and paid-from pricing offer further points to consider. CAIRIS, IriusRisk, and ThreatModeler Nexus are among the options, as are ThreatOpus and ThreatTree. Think about how your team models systems, shares reviews, and decides which risks need attention; then compare those needs with the listed methods, collaboration features, and plan details.
The standings: top 10
| Name | In a line | Record score | Price from | Try it free | Runs on | Facts read |
|---|---|---|---|---|---|---|
| 01 Dethernety | The browser interface is described for security teams, while the CLI supports DevOps teams, CI/CD automation, and threat-model-as-code. | 5.1 | Free plan | Free plan | Web, API, Self-hosted | 15 Oct 2026 |
| 02 OWASP Threat Dragon | Threat Dragon is intended for developers and defenders, and the project says both experienced threat modelers and beginners can use it. | 4.9 | Free plan | Free plan | Web, Windows, Mac, Linux | 3 Oct 2026 |
| 03 ThreatOpus | ThreatOpus is intended for security teams, security champions and platform engineers who want governed threat models and clear merge decisions. | 4.8 | £129.99 a month | Free plan | Web, API | 30 Sep 2026 |
| 04 AWS Threat Composer | Threat Composer suits people modeling system threats, including developers who want to keep models alongside code in version control. | 4.7 | Free plan | Free plan | Web, Windows, Mac, Linux | 3 Oct 2026 |
| 05 CAIRIS | CAIRIS suits teams designing systems that need security and usability considerations alongside requirements and architecture. | 4.7 | Free plan | Free plan | Web, Windows, Mac, Linux | 28 Sep 2026 |
| 06 ThreatForge | ThreatForge suits developers and teams who want visual threat modeling, offline STRIDE analysis and YAML files that can be tracked over time. | 4.7 | Free plan | Free plan | Web, Windows, Mac, Linux | 7 Oct 2026 |
| 07 pytm | pytm suits developers who want to define architecture and threat findings in Python and generate diagrams or reports from that model. | 4.6 | Free plan | Free plan | Windows, Mac, Linux | 8 Oct 2026 |
| 08 ThreatModeler Nexus | ThreatModeler Nexus is aimed at enterprise security, architecture, development, compliance, and risk teams working across large portfolios. | 4.6 | $4,000 a year | Free plan | Web, API, Self-hosted | 30 Sep 2026 |
| 09 ThreatTree | ThreatTree is for security teams, from solo consultants to CISO organizations, that need to model and prioritize risks. | 4.6 | $29 a month | Free plan | Web, API | 30 Sep 2026 |
| 10 ThreatZ | ThreatZ suits vehicle manufacturers and Tier-1 suppliers managing cybersecurity analysis, compliance work, and supply-chain evidence. | 4.6 | $100 a year | Free trial | Web, API, Self-hosted | 4 Oct 2026 |
02
OWASP Threat Dragon
Threat Dragon is intended for developers and defenders, and the project says both experienced threat modelers and beginners can use it.
WebWindowsMac+2 Record4.9 Visit
03
ThreatOpus
ThreatOpus is intended for security teams, security champions and platform engineers who want governed threat models and clear merge decisions.
WebAPI Record4.8 Visit
04
AWS Threat Composer
Threat Composer suits people modeling system threats, including developers who want to keep models alongside code in version control.
WebWindowsMac+4 Record4.7 Visit
05
CAIRIS
CAIRIS suits teams designing systems that need security and usability considerations alongside requirements and architecture.
WebWindowsMac+3 Record4.7 Visit
6
ThreatForge
WebWindowsMac+1 Free plan Record4.7 Visit ThreatForge suits developers and teams who want visual threat modeling, offline STRIDE analysis and YAML files that can be tracked over time.
7
pytm
WindowsMacLinux Free plan Record4.6 Visit pytm suits developers who want to define architecture and threat findings in Python and generate diagrams or reports from that model.
8
ThreatModeler Nexus
WebAPISelf-hosted $4,000 a year Record4.6 Visit ThreatModeler Nexus is aimed at enterprise security, architecture, development, compliance, and risk teams working across large portfolios.
9
ThreatTree
WebAPI $29 a month Record4.6 Visit ThreatTree is for security teams, from solo consultants to CISO organizations, that need to model and prioritize risks.
10
ThreatZ
WebAPISelf-hosted $100 a year Record4.6 Visit ThreatZ suits vehicle manufacturers and Tier-1 suppliers managing cybersecurity analysis, compliance work, and supply-chain evidence.
11
Threagile
WebLinuxAPI+1 Free plan Record4.4 Visit Threagile suits developers working on agile projects or DevSecOps workflows who want to model architecture and track risks in YAML.
12
IriusRisk
WebAPISelf-hosted Free plan Record4.3 Visit IriusRisk is aimed at security teams, developers, CISOs, and compliance teams working on secure software design and threat modeling.
13
ADTool
Free plan Record4.0 Visit ADTool suits people modeling security scenarios that include attacks and defenses, especially those needing attack-path analysis or risk prioritization.
16
CYMETRIS
WebAPISelf-hosted €99 a month Record3.8 Visit CYMETRIS Lite is described for freelance security engineers, consultancies, mobility and vehicle-development startups, automotive supply-chain teams, and service…
17
EnCo SOX ATA
WebWindows — Record3.8 Visit It suits automotive, plant engineering, rail and aerospace teams performing collaborative attack-path and risk analysis within an engineering workbench.
18
itemis SECURE
WebWindows — Record3.7 Visit itemis SECURE is intended for organizations conducting cybersecurity risk analysis, including in automotive and industrial contexts.
19
AutoSec TARA Suite
WebSelf-hosted — Record3.6 Visit The suite suits automotive teams handling concept-phase TARA, supplier reviews, UN R155 evidence, architecture reassessment, or cybersecurity concept work.
More in Developer Tools
Accessibility Testing Software 169Log Management Software 111AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Integrated Development Environments 65Software Composition Analysis Software 65Artifact repository software 64Browser Automation Tools 62Version Control Software 62Container Registries 60Code Playground Software 58Continuous Integration Software 58Network Monitoring 55Kubernetes Monitoring 54Database Client Software 53IDE Software 53