CAIRIS vs IriusRisk

CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.

IriusRisk is an AI threat-modeling tool for planning secure software design. It helps teams build threat models, identify threats and countermeasures, and surface vulnerabilities and compliance gaps. Its Jeff AI Assistant can turn user stories, documentation, meeting transcripts, or code into a diagram showing threats and security controls. A built-in knowledge base supports applying standards such as PCI DSS, NIST, and GDPR, marking aligned countermeasures as required. Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and Open API; users can also import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool. The free Community Edition costs nothing and allows one user and three active threat models. Enterprise has no listed price and is offered as SaaS or on-premise. IriusRisk says its cloud services are not designed or certified for certain sensitive data, including PHI and GDPR special category data.