AutoSec TARA Suite vs Dethernety

AutoSec TARA Suite is a pilot automotive threat-modelling and risk-management platform for analyst-led workflows aligned with ISO/SAE 21434 and UN R155 activities. Its analysis moves through item definition, asset and boundary identification, threat scenarios, attack analysis, impact assessment, and risk determination. Candidate threat scenarios are generated for analyst review and mapped to STRIDE categories. Risk assessment considers safety, financial, operational, and privacy impacts, then calculates attack potential to determine risk. Listed outputs include traceability matrices, PDF and Excel compliance bundles, and VSOC detection rule exports. Deployment options include analyst-led engagements, managed evaluation instances, and self-hosted customer instances. Controlled self-hosted evaluations and technical demonstrations are available on request. The suite is designed to support ISO/SAE 21434, UNECE R155, and ISO 26262 activities, but it does not certify products or organisations. Pricing is available on request.

Dethernety is an open-source threat modeling platform that represents architecture as a graph for building and analyzing system models. Teams can create and explore models in a browser, from code, or from reports. Analysis follows the architecture graph to examine attack paths, blast radius, and residual risk. Exposures map to MITRE ATT&CK techniques and controls to D3FEND countermeasures for coverage-gap analysis. The platform has JavaScript and TypeScript modules for design, analysis, and issues, plus an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation work in both directions. Users host their own graph database, with Neo4j and Memgraph listed as options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on user-controlled infrastructure and can operate fully offline without cloud calls. The maker says models, data, and findings remain on that infrastructure, and that there is no background telemetry or usage-data transmission. The GUI is aimed at security teams; the CLI supports DevOps, CI/CD automation, and threat-model-as-code. Open Source is free; Enterprise is self-hosted with contract pricing and dedicated support.