Best Threat Modeling Software in 2026
Updated
In short: CAIRIS is ranked #1 of 22 as of 4 October 2026, ahead of OWASP Threat Dragon and ThreatOpus. The best-ranked option with a free plan is OWASP Threat Dragon. The lowest first paid tier on this page is ThreatZ at $8.33/mo.
Threat modeling gives teams a way to examine potential risks as they design or assess systems. Compared on modeling methods, templates and frameworks, and risk prioritization, these tools can be weighed against the practices your team uses. Attack-path analysis and collaborative review are also worth comparing, along with deployment options and project limits. Free-plan availability and paid-from pricing provide cost details to consider. CAIRIS, OWASP Threat Dragon, and ThreatOpus are among the options shown. Consider which modeling approaches and review capabilities are relevant to your work, then compare the listed deployment and project criteria to assess fit.
22 threat modeling software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
22ranked
6free plans on this page
$8.33/molowest paid tier
4 Oct 2026last checked
Input list Threat Modeling Software 22 channels on this page · 96 of 176 spec lines stated by the makers
Ch Tool Free planPaid fromProject limitAttack-path analysisRisk prioritizationCollaborative reviewTemplates and frameworksModeling methods Spec sheet Score
01 CAIRIS Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 6/8spec lines stated 7.5
02 OWASP Threat Dragon Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationYesCollaborative reviewnot statedTemplates and frameworksYesModeling methodsmultiple 4/8spec lines stated 7.4
03 ThreatOpus Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 6/8spec lines stated 7.4
04 AWS Threat Composer Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsnot stated 4/8spec lines stated 7.2
05 ThreatModeler Nexus Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewnot statedTemplates and frameworksYesModeling methodsmultiple 5/8spec lines stated 7.1
06 ThreatTree Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 6/8spec lines stated 6.9
07 IriusRisk Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 5/8spec lines stated 6.8
08 ThreatZ Free planNoPaid fromnot statedProject limit3 projectsAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 7/8spec lines stated 6.8
09 itemis SECURE Free plannot statedPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 5/8spec lines stated 6.7
10 CYMETRIS Free planNoPaid fromnot statedProject limit5 projectsAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 7/8spec lines stated 6.5
11 ThreatForge Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationnot statedCollaborative reviewnot statedTemplates and frameworksYesModeling methodsstride 3/8spec lines stated 6.2
12 pytm Free plannot statedPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationYesCollaborative reviewnot statedTemplates and frameworksYesModeling methodscustom 3/8spec lines stated 6.1
13 SD Elements Free planNoPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 5/8spec lines stated 5.9
14 Dethernety Free plannot statedPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsnot stated 4/8spec lines stated 5.8
15 Microsoft Threat Modeling Tool Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 5/8spec lines stated 5.8
16 ADTool Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewNoTemplates and frameworksnot statedModeling methodsmultiple 5/8spec lines stated 5.7
17 AutoSec TARA Suite Free plannot statedPaid fromnot statedProject limitnot statedAttack-path analysisNoRisk prioritizationYesCollaborative reviewnot statedTemplates and frameworksnot statedModeling methodsstride 3/8spec lines stated 5.7
18 KAVACH Free planNoPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksYesModeling methodsmultiple 6/8spec lines stated 5.7
19 Threagile Free plannot statedPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationnot statedCollaborative reviewnot statedTemplates and frameworksYesModeling methodscustom 2/8spec lines stated 5.7
20 EnCo SOX ATA Free plannot statedPaid fromnot statedProject limitnot statedAttack-path analysisYesRisk prioritizationYesCollaborative reviewYesTemplates and frameworksnot statedModeling methodsnot stated 3/8spec lines stated 5.6
21 DevArmor Free planNoPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationnot statedCollaborative reviewnot statedTemplates and frameworksnot statedModeling methodsnot stated 1/8spec lines stated 5.4
22 TSpec Free planYesPaid fromnot statedProject limitnot statedAttack-path analysisnot statedRisk prioritizationnot statedCollaborative reviewnot statedTemplates and frameworksnot statedModeling methodsnot stated 1/8spec lines stated 5.1
Compare all 22 in a table
| # | Tool | Score | Free plan | From | Free plan | Paid from | Project limit | Attack-path analysis |
|---|---|---|---|---|---|---|---|---|
| 1 | CAIRIS | 7.5 | Free plan | Free | Yes | — | — | Yes |
| 2 | OWASP Threat Dragon | 7.4 | Free plan | Free | Yes | — | — | — |
| 3 | ThreatOpus | 7.4 | Free plan | £129.99/mo | Yes | — | — | Yes |
| 4 | AWS Threat Composer | 7.2 | No | — | Yes | — | — | — |
| 5 | ThreatModeler Nexus | 7.1 | Free plan | $333.33/mo | Yes | — | — | Yes |
| 6 | ThreatTree | 6.9 | Free plan | $29/mo | Yes | — | — | Yes |
| 7 | IriusRisk | 6.8 | Free plan | Free | Yes | — | — | — |
| 8 | ThreatZ | 6.8 | No | $8.33/mo | No | — | 3 projects | Yes |
| 9 | itemis SECURE | 6.7 | No | — | — | — | — | Yes |
| 10 | CYMETRIS | 6.5 | No | €99/mo | No | — | 5 projects | Yes |
| 11 | ThreatForge | 6.2 | No | — | Yes | — | — | — |
| 12 | pytm | 6.1 | No | — | — | — | — | — |
| 13 | SD Elements | 5.9 | No | — | No | — | — | — |
| 14 | Dethernety | 5.8 | No | — | — | — | — | Yes |
| 15 | Microsoft Threat Modeling Tool | 5.8 | No | — | Yes | — | — | — |
| 16 | ADTool | 5.7 | No | — | Yes | — | — | Yes |
| 17 | AutoSec TARA Suite | 5.7 | No | — | — | — | — | No |
| 18 | KAVACH | 5.7 | No | — | No | — | — | Yes |
| 19 | Threagile | 5.7 | No | — | — | — | — | — |
| 20 | EnCo SOX ATA | 5.6 | No | — | — | — | — | Yes |
| 21 | DevArmor | 5.4 | No | — | No | — | — | — |
| 22 | TSpec | 5.1 | No | — | Yes | — | — | — |
Is your tool on this list?
Numbered spots on this list can be sponsored, and a sponsored row is labelled as paid.
Questions about this list
Which threat modeling software is ranked first on Specifiction?
CAIRIS is ranked #1 of 22 with a score of 7.5. OWASP Threat Dragon is second and ThreatOpus third.
How many of these have a free plan?
6 of the 22 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, ThreatZ has the lowest first paid tier we found: $8.33/mo.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing.
More in Developer Tools
All developer tools listsAccessibility Testing Software 168Log Management Software 107AI Coding Assistants 103Package Managers 93AI Agent Platforms 73Reverse Engineering Tools 73Software Composition Analysis Software 65Browser Automation Tools 63Integrated Development Environments 62Artifact repository software 60Code Playground Software 58Network Monitoring 56