ThreatOpus

ThreatOpus connects architecture threat modelling to policy checks on pull requests. It suits security teams, security champions and platform engineers who need governed reviews inside CI, while teams seeking only a diagramming tool may find its workflow focus unnecessary. The strongest reason to choose it is the traceable PASS, WARN or FAIL decision attached to a change; the main caution is that generated analysis still requires expert judgment.

Overview

You can describe a system directly, import OpenAPI or Terraform, or link a GitHub repository. ThreatOpus generates STRIDE threats, lets teams track mitigations, and adds attack-path analysis, risk prioritization, collaborative review, templates and multiple modelling methods. Merge Guard evaluates pull requests against policy bundles and posts a decision with reasons to CI checks, turning threat review into a repeatable development checkpoint.

That combination is valuable when security requirements must influence merges rather than remain in a separate document. It is less compelling for organisations that do not use pull-request workflows. Generated threats and mitigations support security work; they do not replace professional assessment, penetration testing or formal risk acceptance.

Key features

Modelling and delivery controls

STRIDE is available on every plan. Pro adds nine further frameworks, making it the practical choice when teams need methodology breadth; Free and Starter remain limited to STRIDE. Merge Guard applies policy bundles to pull requests and explains its outcome in CI, with integrations for GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild and Travis CI.

Slack and Microsoft Teams notifications help route outcomes beyond the CI interface. Scoped API keys in PR Security support custom pipeline steps and internal orchestration, which benefits platform teams with established automation.

Data and account controls

Project settings let teams decide whether raw architecture input is stored, define its retention period and choose whether structured threat output survives raw-input expiry. Signed-in users can export their data as JSON and delete content they created. Email verification, password policies, httpOnly-cookie sessions and optional two-factor authentication provide a sound account baseline. ThreatOpus says it does not sell personal data; customers can request a subprocessor list for security review.

Pricing

PlanPrice and limitsBest forFree£0.00/month; 3 users, 1 workspace, 5 generations/month, 1 repository, 1 SCM or CI provider, STRIDESmall evaluations and individual projectsStarter£129.99/month; 15 users, 10 workspaces, 50 generations/month, 10 repositories, all SCM and CI providers, email supportSmall teams putting governed checks into regular deliveryPro£299.99/month; 50 users, 25 workspaces, 250 generations/month, 50 repositories, nine additional frameworks, eight hours of expert consultation/month, priority supportGrowing security programmes needing scale and methodology choiceEnterpriseCustom pricing; custom users and repositories, unlimited workspaces and generations, all SCM and CI providers, SSO and priority supportLarge organisations requiring negotiated capacity and SSOA free trial is available. Free is tightly capped, especially at five generations and one provider. Starter removes those provider and repository constraints but still limits generations and has only email support. Pro costs more for expanded quotas, consultation and priority support. Enterprise is the route for unlimited generations and custom capacity, but its price is negotiated.

Platforms

ThreatOpus runs through web and API access. Deployment is both, supporting browser use alongside pipeline and orchestration integration.

Who it's for

Choose ThreatOpus when security champions, platform engineers and security teams need threat models connected to source control and CI decisions. The scoped keys, broad provider coverage and retention controls suit governed engineering environments. It is a weaker fit for a standalone, offline modelling practice or for teams unwilling to maintain policy-based merge checks.

Pros and cons

Pros

PASS, WARN and FAIL decisions with reasons make security policy visible at merge time.

OpenAPI, Terraform and GitHub inputs reduce the effort of starting models.

Pro's nine extra frameworks and consultation support more mature programmes.

Retention, export and deletion controls give teams meaningful data-lifecycle choices.

All SCM and CI providers are included from Starter upward.

Cons

Free allows only five generations, one repository and one provider, limiting sustained team use.

Only Pro adds the nine additional frameworks, so lower plans are STRIDE-only.

Generation quotas remain 50 per month on Starter and 250 on Pro.

Generated output cannot substitute for professional assessment or testing.

Alternatives

Threat Modeling Software is the broader category view. Choose CAIRIS for a free Apache-licensed option spanning API, desktop, web and self-hosted use. OWASP Threat Dragon is free, open source and has no stated paid plans or usage limits. AWS Threat Composer is another free option across API, extension, desktop, web and self-hosted environments.

Dethernety suits teams wanting an open-source self-hosted platform with their own graph database. pytm is a free open-source choice for Linux, macOS and Windows. ThreatForge is free, Apache 2.0 software requiring no account. Threagile is a free MIT-licensed toolkit. ThreatModeler Nexus offers a free Community Edition for practitioners before scaling to paid licensing.

Verdict

ThreatOpus is the right choice for teams that want threat modelling to produce governed, explainable CI decisions and need controls around retention and deletion. Choose it especially when integrations, scoped automation keys and collaborative security review matter. Look elsewhere if you need unrestricted free usage, a purely open-source toolkit or assurance that generated analysis replaces specialist security work.