AWS Threat Composer vs CAIRIS

AWS Threat Composer is a threat-modeling project for identifying security issues and developing ways to address them. Its structured threat grammar offers adaptive suggestions for composing threat statements. Models can include architecture and data-flow diagrams, tracked assumptions, links between threats and mitigations, and an insights dashboard with quality metrics and improvement suggestions. Users can manage multiple models and export them as JSON, Markdown, DOCX, or PDF. The web application stores data in the browser, supports import and export, and is available as a hosted demo or as a static site deployed in an AWS account. The VS Code extension in AWS Toolkit edits .tc.json files, works offline, and stores data locally. A browser extension displays threat model files on GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst; it is read-only and requires internet access for web-hosted files. The AI-assisted CLI and MCP server can analyze source code to create starter models, but the tools are experimental. They use AWS Bedrock, and inference costs apply.

CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.