AWS Threat Composer vs IriusRisk

AWS Threat Composer is a threat-modeling project for identifying security issues and developing ways to address them. Its structured threat grammar offers adaptive suggestions for composing threat statements. Models can include architecture and data-flow diagrams, tracked assumptions, links between threats and mitigations, and an insights dashboard with quality metrics and improvement suggestions. Users can manage multiple models and export them as JSON, Markdown, DOCX, or PDF. The web application stores data in the browser, supports import and export, and is available as a hosted demo or as a static site deployed in an AWS account. The VS Code extension in AWS Toolkit edits .tc.json files, works offline, and stores data locally. A browser extension displays threat model files on GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst; it is read-only and requires internet access for web-hosted files. The AI-assisted CLI and MCP server can analyze source code to create starter models, but the tools are experimental. They use AWS Bedrock, and inference costs apply.

IriusRisk is an AI threat-modeling tool for planning secure software design. It helps teams build threat models, identify threats and countermeasures, and surface vulnerabilities and compliance gaps. Its Jeff AI Assistant can turn user stories, documentation, meeting transcripts, or code into a diagram showing threats and security controls. A built-in knowledge base supports applying standards such as PCI DSS, NIST, and GDPR, marking aligned countermeasures as required. Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and Open API; users can also import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool. The free Community Edition costs nothing and allows one user and three active threat models. Enterprise has no listed price and is offered as SaaS or on-premise. IriusRisk says its cloud services are not designed or certified for certain sensitive data, including PHI and GDPR special category data.