Skip to content
SPECIFICTION
Get listed

pytm

github.com

Free plan WindowsmacOSLinux
Visit github.com
Spec score 7.6 #10 of 23 in Threat Modeling Software

What it is

pytm is a free, open-source Python framework for creating threat models from architectural descriptions. A model is defined in Python with elements such as servers, data stores, actors, processes, data flows, and trust boundaries. From it, pytm can generate data flow diagrams, sequence diagrams, and relevant threats. Templates can produce reports with diagrams and findings, and a RevealMD template can create slides for browser presentation. Data flow diagrams use Graphviz DOT, while sequence diagrams use PlantUML. Models can be imported from JSON with pytm's Python load function. Users can supply a custom threats file and change finding attributes such as CVSS score, response text, and severity. Requirements include Python 3.11 or later, Graphviz, Java OpenJDK 10 or 11, and plantuml.jar; Linux and macOS are listed, while Windows use is documented through Devbox in WSL. The project also documents container and Devbox dependency workflows. The README warns that strings in threats.json are evaluated with eval(), so the file's permissions need protection against unauthorized changes.

Spec sheet

Purpose
pytm is a Pythonic framework for threat modeling intended to make threat modeling more automated and developer-centric.Read 8 Oct 2026 · github.com
Intended users
The project describes its goal as shifting threat modeling earlier and making it more automated and developer-centric.Read 8 Oct 2026 · github.com
Maker
OWASP describes itself as a nonprofit foundation dedicated to improving software security through open-source collaboration, education, and innovation.Read 8 Oct 2026 · owasp.org
Diagram integrations
Diagram output uses Graphviz DOT for data flow diagrams and PlantUML for sequence diagrams.Read 8 Oct 2026 · github.com
Generated outputs
From an architectural model, pytm can generate data flow diagrams, sequence diagrams, and relevant threats.Read 8 Oct 2026 · github.com
Model import
A threat model can be imported from JSON using pytm's Python load function.Read 8 Oct 2026 · github.com
Modeling approach
Threat models are defined in Python using elements such as servers, data stores, actors, processes, data flows, and trust boundaries.Read 8 Oct 2026 · github.com
Other tooling
The project documents container and Devbox workflows for managing dependencies, and uses Pandoc in its example report-generation command.Read 8 Oct 2026 · github.com
Platform requirements
The listed requirements are Linux or macOS, Python 3.11 or later, Graphviz, Java OpenJDK 10 or 11, and plantuml.jar.Read 8 Oct 2026 · github.com
Reports and slides
Templates can produce reports containing diagrams and findings, and a RevealMD template can create browser-presentable slides.Read 8 Oct 2026 · github.com
Security caution
The README warns that strings in threats.json are evaluated with eval() and says to protect the file's permissions to prevent code execution by an attacker who can change those strings.Read 8 Oct 2026 · github.com
Threat customization
Users can provide a custom threats file and override finding attributes such as CVSS score, response text, and severity.Read 8 Oct 2026 · github.com
Windows usage
The project documents a Devbox setup for Windows through WSL.Read 8 Oct 2026 · github.com

Plans and prices

Open-source pytm Free Python 3.11+ · Requires Graphviz and Java/PlantUML for diagram generation Read 8 Oct 2026 · github.com

Every pytm plan and price →

Strong points and limits

Strong points

  • Generates data flow and sequence diagrams from models
  • Supports custom threats and finding attributes
  • Can import models from JSON
  • Free and open source

Limits

  • Requires Python 3.11 or later
  • Diagram generation requires Graphviz and Java/PlantUML
  • Windows setup is documented through WSL
  • threats.json strings are evaluated with eval()

Who it suits

pytm suits developers who want to define threat models in Python and generate diagrams, threats, and reports from them. It is for users able to manage its listed runtime and diagram-generation dependencies.

Verdict

pytm turns Python-defined architecture into diagrams, findings, and reports, with customization for threats and findings. Protect threats.json and account for the dependency requirements, especially when generating diagrams.

Where Specifiction places it

Alternatives to pytmAll alternatives →