Skip to content
SPECIFICTION
Get listed

Dethernety

dether.net

Free plan Open source WebAPISelf-hosted
Visit dether.net
Spec score 8.7 #1 of 23 in Threat Modeling Software

What it is

Dethernety is an open-source threat modeling platform that represents architecture as a graph for building and analyzing system models. Teams can create and explore models in a browser, from code, or from reports. Analysis follows the architecture graph to examine attack paths, blast radius, and residual risk. Exposures map to MITRE ATT&CK techniques and controls to D3FEND countermeasures for coverage-gap analysis. The platform has JavaScript and TypeScript modules for design, analysis, and issues, plus an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation work in both directions. Users host their own graph database, with Neo4j and Memgraph listed as options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on user-controlled infrastructure and can operate fully offline without cloud calls. The maker says models, data, and findings remain on that infrastructure, and that there is no background telemetry or usage-data transmission. The GUI is aimed at security teams; the CLI supports DevOps, CI/CD automation, and threat-model-as-code. Open Source is free; Enterprise is self-hosted with contract pricing and dedicated support.

Spec sheet

Purpose
Dethernety is a graph-native threat modeling platform for building and analyzing architecture models.Read 8 Oct 2026 · dether.net
Intended users
The maker describes the GUI for security teams and the CLI for DevOps teams, with the CLI supporting CI/CD automation and threat-model-as-code.Read 8 Oct 2026 · dether.net
Integrations
Issue modules can connect with external trackers and sync remediation issues bidirectionally.Read 8 Oct 2026 · dether.net
Support
The Enterprise edition includes dedicated support and deployment help.Read 8 Oct 2026 · dether.net
License
The public repository is licensed GNU Affero General Public License version 3.0, AGPL-3.0-only.Read 15 Oct 2026 · github.com
AI analysis
Analysis options include deterministic queries, single-agent AI acceleration, and multi-agent LangGraph workflows.Read 8 Oct 2026 · dether.net
Analysis engines
Analysis can use deterministic queries, single-agent AI acceleration or multi-agent LangGraph workflows.Read 15 Oct 2026 · dether.net
Availability limits
BYODt and BYODt Team are described as coming soon, while Hosted SaaS is planned for later; package composition and pricing are still being finalized.Read 8 Oct 2026 · dether.net
Claude Code integration
The Dethereal Claude Code plugin provides 14 slash commands, 5 specialized agents and 22 MCP tools.Read 15 Oct 2026 · github.com
CLI workflow
The CLI supports CI/CD automation and threat-model-as-code with version control.Read 15 Oct 2026 · dether.net
Company founder
Levente Simon is identified as Dethernety's founder and creator, with more than 25 years in strategy, leadership, architecture and software development.Read 15 Oct 2026 · dether.net
Container quickstart
The BYODt deployment requires Docker with Compose or Podman 4.1 or newer and runs from signed images.Read 15 Oct 2026 · github.com
Data handling
The maker says models, data, and findings stay on the user's infrastructure; optional cloud evaluations send only closed-vocabulary configuration attributes and discard the payloads.Read 8 Oct 2026 · dether.net
Deployment prerequisites
The documented source setup requires Node.js 18 or newer, pnpm 9.13 or newer, Neo4j or Memgraph and an OIDC provider.Read 15 Oct 2026 · github.com
Deterministic analysis
The platform computes exposures, controls and attack paths from the model and links findings to evidence.Read 15 Oct 2026 · dether.net
Documentation
The repository includes user guides, architecture documentation, configuration guidance, security-model documentation and module-development documentation.Read 15 Oct 2026 · github.com
Evidence sources
Module findings cite sources including CVE, NIST 800-53, CWE, CIS, MITRE ATT&CK and D3FEND.Read 15 Oct 2026 · dether.net
File portability
Models can be exported as JSON or split-file ZIPs, versioned with code, edited offline and re-imported.Read 15 Oct 2026 · github.com
Graph databases
The platform names Neo4j and Memgraph as graph database options, and users host their own graph database.Read 8 Oct 2026 · dether.net
Graph queries
Attack paths, blast radius and chokepoints are analyzed as graph operations rather than table joins.Read 15 Oct 2026 · dether.net
Graph storage
Models are stored as graph structures in Neo4j or Memgraph, with components, flows, boundaries and controls represented as nodes and relationships.Read 15 Oct 2026 · github.com
Independent directory description
Toreon describes Dethernety as a visual graph-native threat-modeling tool that analyzes architectural attack paths and produces MITRE-mapped findings.Read 15 Oct 2026 · github.com
Independent directory listing
Toreon's threat-modeling directory lists Dethernety as a 2026 personal release by Velnomix, active, AI-capable and AGPL-3.0-only.Read 15 Oct 2026 · github.com
Issue management
Findings can create issues and synchronize remediation with external trackers through issue modules.Read 15 Oct 2026 · dether.net
Limit: no attacker model
Threat Report says it shows reachability routes but does not model attacker effort, credential reuse or exploit chaining.Read 15 Oct 2026 · dether.net
Limit: not a live scan
Threat Report explicitly says its coverage is modelled or design-asserted and is not telemetry from a running system.Read 15 Oct 2026 · dether.net
Limit: planned hosted service
The fully managed Hosted SaaS edition is marked planned for later rather than generally available.Read 15 Oct 2026 · dether.net
Limit: snapshot freshness
Reports render from stored snapshots, become stale after model edits and do not update automatically.Read 15 Oct 2026 · dether.net
MITRE mapping
Exposures map to MITRE ATT&CK techniques and controls map to D3FEND countermeasures.Read 15 Oct 2026 · dether.net
Modeling
The platform lets users build and explore threat models visually in a browser, from code, or from reports.Read 8 Oct 2026 · dether.net
Module catalog
The maker reports more than 30 specialized modules, 450 modeled classes, 9,500 configurable attributes, 4,000 evaluated threats, 650 cited sources and 240 ATT&CK techniques.Read 15 Oct 2026 · dether.net
Modules
Its runtime JavaScript and TypeScript module ecosystem includes design, analysis, and issue classes, with an OPA/Rego policy engine.Read 8 Oct 2026 · dether.net
Notable news: blog launch
A Dethernety blog article titled “The Lost Science: How We Forgot Security Was a Graph Problem” was published March 9, 2026.Read 15 Oct 2026 · dether.net
Notable news: Dethereal article
The maker published “Eleven Steps You Don't Type,” describing the Dethereal guided workflow, on April 20, 2026.Read 15 Oct 2026 · dether.net
Plugin architecture
JavaScript and TypeScript modules can define design classes, analysis classes, issue classes and frontend or backend extensions.Read 15 Oct 2026 · dether.net
Policy engine
Modules can use OPA/Rego for declarative detection rules.Read 15 Oct 2026 · github.com
Product purpose
Dethernety is a graph-native threat-modeling platform that models architecture and analyzes attack paths, impact and dependencies.Read 15 Oct 2026 · dether.net
Public API
A GraphQL API is exposed at the local /graphql endpoint in source deployments.Read 15 Oct 2026 · github.com
Repository activity
The public GitHub repository shows 217 commits, 19 pull requests, 1 issue, 3 stars and 0 forks on the page reviewed.Read 15 Oct 2026 · github.com
Risk analysis
It analyzes attack paths, blast radius, and residual risk using the context of the full architecture graph.Read 8 Oct 2026 · dether.net
Security boundary
The platform states that models, data and findings remain on the customer's infrastructure; optional cloud evaluation sends only closed-vocabulary attributes.Read 15 Oct 2026 · dether.net
Self-hosting
The stack can run on customer cloud, on-premises or fully air-gapped infrastructure using Compose or an image-based VM.Read 15 Oct 2026 · dether.net
Technology coverage
Named module areas include AWS, Azure, Kubernetes, containers and self-managed infrastructure.Read 15 Oct 2026 · dether.net
Technology stack
The maker identifies Vue.js, NestJS, GraphQL, Neo4j, LangGraph and AWS as the production technology stack.Read 15 Oct 2026 · dether.net
Telemetry
The maker says the platform sends no background telemetry or usage data and contacts the cloud only when users fetch modules or request evaluations.Read 8 Oct 2026 · dether.net
Telemetry policy
The editions page says the platform makes no background telemetry or usage-data calls and contacts cloud services only for module fetching or evaluations.Read 15 Oct 2026 · dether.net
Threat frameworks
Exposures map to MITRE ATT&CK techniques and controls map to D3FEND countermeasures for coverage gap analysis.Read 8 Oct 2026 · dether.net
Visual modeling
The browser GUI provides drag-and-drop modeling of components, boundaries, trust zones and data flows.Read 15 Oct 2026 · dether.net

Plans and prices

Open Source Free Full platform · self-hosted · bring your own graph database · offline-capable Read 15 Oct 2026 · dether.net
BYODt Priced on request Pricing being finalized Self-hosted · cloud-served specialized modules · closed-vocabulary attributes only leave your network Read 15 Oct 2026 · dether.net
BYODt Team — 5 or 20 seats Priced on request Pricing being finalized 5 or 20 seats · self-hosted · shared package access Read 15 Oct 2026 · dether.net
Enterprise Priced on request By contract Self-hosted · own identity provider · air-gap-friendly · dedicated support Read 15 Oct 2026 · dether.net
Hosted SaaS Priced on request Planned later Per-customer isolated managed deployment · separate network, identity, storage and compute Read 15 Oct 2026 · dether.net

Every Dethernety plan and price →

Strong points and limits

Strong points

  • Free open-source edition is self-hosted.
  • Can operate fully offline without cloud calls.
  • Maps exposures and controls to named frameworks.
  • Supports external issue trackers with bidirectional sync.
  • Analysis includes deterministic and AI-assisted options.

Limits

  • Users must host their own graph database.
  • Enterprise pricing is by contract.
  • Hosted SaaS is planned for later.
  • BYODt and BYODt Team are coming soon.

Who it suits

Dethernety suits security teams modeling architecture and DevOps teams automating threat-model work through the CLI. It is relevant to organizations that want to host their graph database and platform infrastructure themselves.

Verdict

Dethernety offers graph-based threat analysis with self-hosted and offline operation in its open-source edition. Its fit depends on teams being prepared to manage their own infrastructure and graph database.

Where Specifiction places it

Alternatives to DethernetyAll alternatives →