AutoSec TARA Suite vs ThreatTree

AutoSec TARA Suite is a pilot automotive threat-modelling and risk-management platform for analyst-led workflows aligned with ISO/SAE 21434 and UN R155 activities. Its analysis moves through item definition, asset and boundary identification, threat scenarios, attack analysis, impact assessment, and risk determination. Candidate threat scenarios are generated for analyst review and mapped to STRIDE categories. Risk assessment considers safety, financial, operational, and privacy impacts, then calculates attack potential to determine risk. Listed outputs include traceability matrices, PDF and Excel compliance bundles, and VSOC detection rule exports. Deployment options include analyst-led engagements, managed evaluation instances, and self-hosted customer instances. Controlled self-hosted evaluations and technical demonstrations are available on request. The suite is designed to support ISO/SAE 21434, UNECE R155, and ISO 26262 activities, but it does not certify products or organisations. Pricing is available on request.

ThreatTree is a browser-based tool for organizing threat models into forests of Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then generates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK; mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. Teams can invite members with owner, editor, or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan, including Free. ThreatTree says data is stored on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are taken daily and retained for 30 days. The Free plan costs nothing and has limits on forests and trees. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote.