CAIRIS vs pytm

CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.

pytm is a free, open-source Python framework for creating threat models from architectural descriptions. A model is defined in Python with elements such as servers, data stores, actors, processes, data flows, and trust boundaries. From it, pytm can generate data flow diagrams, sequence diagrams, and relevant threats. Templates can produce reports with diagrams and findings, and a RevealMD template can create slides for browser presentation. Data flow diagrams use Graphviz DOT, while sequence diagrams use PlantUML. Models can be imported from JSON with pytm's Python load function. Users can supply a custom threats file and change finding attributes such as CVSS score, response text, and severity. Requirements include Python 3.11 or later, Graphviz, Java OpenJDK 10 or 11, and plantuml.jar; Linux and macOS are listed, while Windows use is documented through Devbox in WSL. The project also documents container and Devbox dependency workflows. The README warns that strings in threats.json are evaluated with eval(), so the file's permissions need protection against unauthorized changes.