ADTool vs ThreatTree

ADTool is free software for modeling and analyzing attack-defense scenarios. It uses attack-defense trees, attack-defense terms, and sequential attack trees, following a methodology developed through the ATREES, TREsPASS, and ADT2P projects. Users can create and edit trees, then perform quantitative bottom-up analysis. A modular display is intended for large real-life scenarios. The tool can rank possible attacks for selected attribute domains, supporting attack-path analysis and risk prioritization. Models can be saved, printed, exported to several formats, and given customized layouts. The maker lists a new beta release and an earlier stable release. The new version requires JDK 7 or later. The stable package is offered as a dependency-included jar of about 6.6 MB or a light package of about 1100 kB. A previous-version manual and source code for both versions are available. The project is associated with the University of Luxembourg’s Security and Trust of Software Systems group.

ThreatTree is a browser-based tool for organizing threat models into forests of Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then generates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK; mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. Teams can invite members with owner, editor, or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan, including Free. ThreatTree says data is stored on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are taken daily and retained for 30 days. The Free plan costs nothing and has limits on forests and trees. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote.