CYMETRIS vs Dethernety

CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.

Dethernety is an open-source threat modeling platform that represents architecture as a graph for building and analyzing system models. Teams can create and explore models in a browser, from code, or from reports. Analysis follows the architecture graph to examine attack paths, blast radius, and residual risk. Exposures map to MITRE ATT&CK techniques and controls to D3FEND countermeasures for coverage-gap analysis. The platform has JavaScript and TypeScript modules for design, analysis, and issues, plus an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation work in both directions. Users host their own graph database, with Neo4j and Memgraph listed as options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on user-controlled infrastructure and can operate fully offline without cloud calls. The maker says models, data, and findings remain on that infrastructure, and that there is no background telemetry or usage-data transmission. The GUI is aimed at security teams; the CLI supports DevOps, CI/CD automation, and threat-model-as-code. Open Source is free; Enterprise is self-hosted with contract pricing and dedicated support.