CAIRIS vs ThreatModeler Nexus

CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.

ThreatModeler Nexus is an agentic platform for secure design and governed threat modeling across applications, cloud and hybrid architectures, devices, and operational technology. Its Secure Design Graph connects architectures, threats, controls, compliance requirements, and security decisions. System Mapping, Graph, and Reporting agents operate on that graph. Supported methods include STRIDE, PASTA, and CSA MAESTRO for agentic systems, and findings map to more than 180 regulatory and security frameworks, including NIST, ISO 27001, PCI DSS, HIPAA, DORA, and the EU AI Act. A built-in MCP Server checks pull requests and commits against the current threat model and returns threats, requirements, and mitigations in developer workflows. Integrations include infrastructure tools, cloud providers, code platforms, ServiceNow, and ArmorCode. Customers can connect their own AI model, with a deterministic framework governing output. Web, API, and self-hosted environments are listed. A free Community Edition is available; the ThreatModeler license costs $4,000 a year on a 12-month contract. Additional AWS infrastructure costs may apply.