AWS Threat Composer

AWS Threat Composer is a threat-modeling workspace for turning security concerns into structured, reviewable models. It suits security and engineering teams that want model files beside their code, as well as practitioners who prefer a browser workflow or a self-hosted deployment. The strongest case is its combination of disciplined threat writing, diagrams, exports, and several integration choices; its experimental AI features and browser-extension constraints require more care.

Overview

Threat Composer supports an iterative process for identifying security issues and deciding how to address them. Structured threat grammar and adaptive suggestions help shape consistent threat statements, while architecture and data-flow diagrams provide system context. Assumptions can be tracked and connected to threats and mitigations, and an insights dashboard supplies quality metrics and improvement suggestions. Risk prioritization and collaborative review are part of the modeling workflow.

Users can manage multiple models and export them as JSON, Markdown, DOCX, or PDF. The web application keeps data in browser storage and supports import and export. It can be used as a hosted demo or deployed as a static site in an AWS account for customization. That makes it suitable both for a quick start and for organizations that want control over deployment.

For a broader comparison set, see our Threat Modeling Software list.

Key features

Structured modeling

The grammar-based writing system gives threat statements a repeatable form, with adaptive prompts that help develop them. This is more useful for teams standardizing review language than for people seeking an unstructured notes tool.

Model context and review

Architecture and data-flow diagrams, assumptions, linked mitigations, risk prioritization, and an insights dashboard keep a model connected to the system it describes. Quality metrics and improvement suggestions can focus review, while collaborative review supports team sign-off.

Files, exports, and integrations

JSON, Markdown, DOCX, and PDF exports make models portable across documentation and review processes. The VS Code extension, included in AWS Toolkit, edits .tc.json files offline and stores data locally, so teams can keep models under version control alongside source code. The browser extension displays model files on GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst, with configurable URL patterns for self-hosted instances.

The browser extension is read-only, needs an internet connection to load web files, and may take time with large models. Its documentation says it neither collects nor transmits data, uses no analytics or tracking, and makes no external API calls. Chrome Web Store and Firefox Add-ons publication is not yet available, which limits its distribution.

AI-assisted generation

An AI CLI and MCP server can analyze source code and produce starter threat models. They are marked experimental, so they are best treated as accelerators for initial work rather than authoritative analysis. They use AWS Bedrock, and its inference costs apply; teams need to budget that usage separately from the free project.

Pricing

AWS Threat Composer is free, with a free plan and no paid tiers described. That makes it a practical fit for individuals, open-source projects, and teams that can operate their own workflow without commercial seat or usage commitments. The free offering does not remove the infrastructure distinction: self-hosting uses an AWS account, and AI CLI or MCP activity incurs Bedrock inference charges.

Platforms

Threat Composer spans web, Windows, macOS, Linux, API, self-hosted deployment, and extensions. The hosted web app is convenient for browser-based work; self-hosting provides an AWS-based, customizable static deployment. VS Code adds offline local editing, while the repository browser extension is for online, read-only viewing.

Who it's for

Choose it if you want structured threat statements, diagrams, assumptions, mitigation links, quality guidance, and portable exports in one free tool. It is especially well suited to development teams keeping threat models in version control through VS Code, and to organizations that need a self-hosted web deployment. It is less suitable when you require a polished, fully supported commercial service, editable browser-based repository integration, or production-ready AI automation.

Pros and cons

Pros: Structured grammar and adaptive suggestions make threat writing more consistent.

Pros: Diagrams, assumptions, risk prioritization, mitigation links, collaborative review, and insights connect analysis to action.

Pros: JSON, Markdown, DOCX, and PDF exports support downstream documentation.

Pros: Offline VS Code editing and local files fit version-controlled engineering workflows.

Cons: AI generation is experimental and adds variable AWS Bedrock inference costs.

Cons: The browser extension is read-only, requires internet access, and can be slow with large models.

Cons: Browser-store publication is not yet available, limiting extension distribution.

Alternatives

CAIRIS is a free Apache-licensed option across web, desktop, API, and self-hosted environments. OWASP Threat Dragon is a free open-source desktop, web, and self-hosted alternative with no paid plans or usage limits stated. ThreatOpus suits teams wanting a hosted, paid workflow: its Starter plan costs £129.99 per month for 15 users, 10 workspaces, 50 generations monthly, 10 repositories, and SCM and CI integrations.

Dethernety is worth considering for a self-hosted open-source platform with a bring-your-own graph database, while its Enterprise edition uses contract pricing. pytm is a free open-source choice for Linux, macOS, and Windows. ThreatForge provides a free Apache 2.0 application with no account requirement. Threagile is a free MIT-licensed toolkit for API, web, Linux, and self-hosted use. ThreatModeler Nexus offers a free Community Edition for practitioners and teams, with paid licensing for scaling.

Verdict

AWS Threat Composer is a strong choice for teams that want a free, code-adjacent threat-modeling workflow with structured writing, rich model context, offline VS Code editing, and flexible exports or deployment. Look elsewhere if you need an editable browser extension, a fully mature AI generator, or a commercial support and pricing model built around guaranteed service tiers.