Skip to content
SPECIFICTION
Get listed

ThreatTree

threattree.com

From $29/mo Free plan WebAPI
Visit threattree.com
Spec score 7.7 #9 of 23 in Threat Modeling Software

What it is

ThreatTree is a browser-based tool for organizing threat models into forests of Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then generates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK; mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. Teams can invite members with owner, editor, or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan, including Free. ThreatTree says data is stored on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are taken daily and retained for 30 days. The Free plan costs nothing and has limits on forests and trees. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote.

Spec sheet

Purpose
ThreatTree organizes threat models into forests containing Data Flow Diagrams and Attack Trees.Read 30 Sep 2026 · threattree.com
Intended users
ThreatTree describes itself as a browser-based tool for security teams ranging from solo consultants to CISO organizations.Read 30 Sep 2026 · threattree.com
Integrations
The Enterprise plan lists custom Jira and ServiceNow ticketing, Terraform/OpenAPI architecture import, Splunk and Microsoft Sentinel feeds, GRC platform sync, and Confluence/Notion embeds.Read 30 Sep 2026 · threattree.com
Support
The pricing page lists priority support with Pro and dedicated support and an SLA with Enterprise.Read 30 Sep 2026 · threattree.com
Headquarters
United KingdomRead 28 Sep 2026 · threattree.com
Backups
Database backups are taken daily, retained for 30 days, encrypted, and stored separately from the primary data store.Read 30 Sep 2026 · threattree.com
Certification
ThreatTree says it is not currently SOC 2 or ISO 27001 certified and that formal certification is on its roadmap.Read 30 Sep 2026 · threattree.com
Collaboration
The product supports owner, editor, and viewer roles for invited team members.Read 30 Sep 2026 · threattree.com
Controls
Mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2.Read 30 Sep 2026 · threattree.com
Encryption
Optional per-forest AES-256-GCM encryption is available on every plan, including Free.Read 30 Sep 2026 · threattree.com
Frameworks
Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK.Read 30 Sep 2026 · threattree.com
Hosting and transport
ThreatTree says data is stored on UK servers and connections use TLS 1.2 or higher.Read 30 Sep 2026 · threattree.com
Maker location
The maker says its team is based in the United Kingdom.Read 30 Sep 2026 · threattree.com
Reports and exports
ThreatTree offers PDF reports and supports JSON and STIX 2.1 exports.Read 30 Sep 2026 · threattree.com
Risk analysis
Likelihood-by-impact scoring automatically generates a ranked risk register across trees in a forest.Read 30 Sep 2026 · threattree.com

Plans and prices

Free Free Up to 3 forests · Up to 3 DFDs per forest · Up to 5 Attack Trees per DFD Read 30 Sep 2026 · threattree.com
Pro $29 a month per user, monthly Unlimited forests & trees · Team collaboration · Full report generation · Priority support Read 30 Sep 2026 · threattree.com
Enterprise Priced on request Quote on request; pricing depends on org size & requirements SSO/SAML · Custom roles and data retention · Multi-org management · Custom integrations · Dedicated/VPC deployment option · Dedicated support & SLA Read 30 Sep 2026 · threattree.com

Every ThreatTree plan and price →

Strong points and limits

Strong points

  • Generates a ranked risk register from likelihood and impact.
  • Supports several threat-tagging frameworks.
  • Offers JSON and STIX 2.1 exports.
  • Optional per-forest encryption is available on every plan.
  • Invited members can have owner, editor, or viewer roles.

Limits

  • Free plan allows up to three forests.
  • Pro costs $29 a month per user.
  • ThreatTree is not currently SOC 2 certified.
  • ThreatTree is not currently ISO 27001 certified.

Who it suits

ThreatTree is intended for security teams ranging from solo consultants to CISO organizations. Its forests, diagrams, and risk register suit teams that need to organize and review threat models.

Verdict

ThreatTree brings structured threat modeling, framework tags, and risk ranking together with team roles and export options. The free plan has model-count limits, and organizations requiring current SOC 2 or ISO 27001 certification should note that neither is in place.

Where Specifiction places it

Alternatives to ThreatTreeAll alternatives →