CYMETRIS vs OWASP Threat Dragon
CYMETRIS
cymetris.comOWASP Threat Dragon
threatdragon.comSide by side
| Figure | CYMETRIS | OWASP Threat Dragon |
|---|---|---|
| Price from | €99/mo | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Threat Modeling Software | 7.9 (#5) | 7.9 (#6) |
| Intended users | The maker describes CYMETRIS Lite as suitable for freelance security engineers, consultancies, mobility and vehicle-development startups, automotive supply-chain security teams, and service providers running TARAs. | OWASP describes Threat Dragon as intended for developers and defenders, and says both experienced threat modelers and beginners can use it. |
| Purpose | CYMETRIS is a software platform for cyber risk analysis and TARA across the product lifecycle. | Threat Dragon creates threat model diagrams and lists threats for diagram elements as part of a secure development lifecycle. |
| Support | Lite support is ticket-based with responses within less than one week; Enterprise includes priority support with a dedicated contact and SLA. | The project directs users to its mailing list, OWASP Slack channel, GitHub issues and public discussions for questions, bugs and feature requests. |
Plans
In their own words
CYMETRIS
CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.
OWASP Threat Dragon
OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.