OWASP Threat Dragon

OWASP Threat Dragon is a free threat-modeling tool for developers and defenders who want to connect system diagrams with structured security analysis. It suits both newcomers and experienced modelers; its range of deployment and storage choices is a strong fit for teams that want control over their models, though volunteer maintenance is a real operational trade-off.

Overview

Threat Dragon brings threat modeling into the secure development lifecycle by pairing diagrams with threat lists for their elements. Teams can map processes, data stores, actors, data flows and trust boundaries, then use the resulting model to examine risk. The project supports several threat frameworks and modeling methods, making it adaptable to different analysis practices without a software charge.

The main caveat is support responsiveness: volunteers maintain the project, and immediate investigation or incident response is not always possible. That may be acceptable for teams with their own incident processes, but organizations that depend on a vendor for prompt response should weigh the risk carefully.

Key features

A rule engine suggests threats and mitigations, including context-specific suggestions based on diagram-element properties. This gives users a structured starting point for analysis rather than a diagram alone, while leaving teams responsible for assessing which suggestions apply. Supported categories include STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai. Risk prioritization, templates and multiple modeling methods add useful structure for teams with established review practices or those still learning how to model threats.

Storage depends on the edition. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab. The desktop app saves models locally. This flexibility helps teams fit the tool to existing repositories or keep work on a local machine, but the project does not describe a managed hosted service.

The project reports signed commits, full-length SHAs for supply-chain actions, signed and notarized desktop releases where possible, and automated dependency, SAST, DAST and container security scans on every commit. Analytics are disabled by default, require server configuration and do not collect threat-model content or usernames for Plausible. These practices are useful considerations for security-conscious teams, though they do not remove the volunteer-maintenance limitation.

Pricing

Threat Dragon has one Free plan at free, open source. No paid plans or usage limits are stated. That makes it a straightforward choice for individuals and teams seeking a no-cost tool without a stated usage cap; it does not come with a paid tier for teams that want a different support arrangement.

Platforms

Threat Dragon runs as a desktop application or a containerized, self-hosted web application. Desktop installers are provided for Windows, macOS and Linux; the web app supports self-hosted deployment. The choice suits users who want local desktop work or organizations prepared to operate their own web instance.

Who it's for

Developers and defenders can use Threat Dragon to put threat modeling into development work, and the project describes it as suitable for beginners as well as experienced modelers. It is particularly well matched to teams that value framework choice, local storage or self-hosting. Teams requiring dependable immediate incident investigation or response should consider a product with support commitments that fit that need.

Pros and cons

Pros: Free, open-source access with no usage limits stated, useful for teams that need to begin modeling without a software budget.

Pros: A rule engine, multiple threat categories, risk prioritization, templates and modeling methods support structured analysis.

Pros: Desktop, self-hosted web and several configurable storage integrations give teams control over deployment and model storage.

Cons: Volunteer maintenance means immediate incident investigation or response is not always possible, a concern for organizations relying on rapid vendor support.

Cons: Web deployment is self-hosted, so teams choosing it need to run the application themselves.

Alternatives

Threat Modeling Software is the broader category directory for comparing tools. CAIRIS is another free option, with Linux, macOS, Windows, web, API and self-hosted platforms; consider it when those platform choices suit your workflow. ThreatOpus offers a freemium model and free trial, with a Starter plan at £129.99 a month, billed £129.99/month; its stated allowance includes 15 users, 10 team workspaces, 50 threat modelling generations per month and 10 repositories, alongside SCM and CI providers. Choose it when those team allowances and integrations fit your needs and a paid plan is acceptable.

AWS Threat Composer is a free alternative available on web, API, extension, desktop and self-hosted platforms. ThreatForge is free and open source under Apache 2.0, requires no account and makes the full application available to everyone; it is a natural option when that access model matters. ThreatModeler Nexus has a free Community Edition for practitioners, students, developers, architects and security teams to try threat modeling before scaling, with API, self-hosted and web platforms.

ThreatTree has a free tier capped at three forests, three DFDs per forest and five Attack Trees per DFD, plus a Pro plan at $29 a month billed per user, monthly. Choose it if those free limits are sufficient or its paid tier fits your needs. IriusRisk offers a free Community Edition capped at three active threat models and one user with limited collaboration, with templates and libraries and XML diagram export; it may suit a single-user workflow within those limits. ThreatZ is a paid alternative with a free trial.

Verdict

Choose OWASP Threat Dragon if you want a free, open-source way to build threat diagrams, organize analysis across multiple frameworks and keep models local or on infrastructure you control. Its flexibility and lack of stated usage limits are compelling; its volunteer maintenance is the main reason to look elsewhere if prompt incident response is essential.