AWS Threat Composer vs Dethernety

AWS Threat Composer is a threat-modeling project for identifying security issues and developing ways to address them. Its structured threat grammar offers adaptive suggestions for composing threat statements. Models can include architecture and data-flow diagrams, tracked assumptions, links between threats and mitigations, and an insights dashboard with quality metrics and improvement suggestions. Users can manage multiple models and export them as JSON, Markdown, DOCX, or PDF. The web application stores data in the browser, supports import and export, and is available as a hosted demo or as a static site deployed in an AWS account. The VS Code extension in AWS Toolkit edits .tc.json files, works offline, and stores data locally. A browser extension displays threat model files on GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst; it is read-only and requires internet access for web-hosted files. The AI-assisted CLI and MCP server can analyze source code to create starter models, but the tools are experimental. They use AWS Bedrock, and inference costs apply.

Dethernety is an open-source threat modeling platform that represents architecture as a graph for building and analyzing system models. Teams can create and explore models in a browser, from code, or from reports. Analysis follows the architecture graph to examine attack paths, blast radius, and residual risk. Exposures map to MITRE ATT&CK techniques and controls to D3FEND countermeasures for coverage-gap analysis. The platform has JavaScript and TypeScript modules for design, analysis, and issues, plus an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation work in both directions. Users host their own graph database, with Neo4j and Memgraph listed as options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on user-controlled infrastructure and can operate fully offline without cloud calls. The maker says models, data, and findings remain on that infrastructure, and that there is no background telemetry or usage-data transmission. The GUI is aimed at security teams; the CLI supports DevOps, CI/CD automation, and threat-model-as-code. Open Source is free; Enterprise is self-hosted with contract pricing and dedicated support.