CYMETRIS vs Threagile
CYMETRIS
cymetris.comThreagile
threagile.ioSide by side
| Figure | CYMETRIS | Threagile |
|---|---|---|
| Price from | €99/mo | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Threat Modeling Software | 7.9 (#5) | 7.6 (#11) |
| Headquarters | CYMETRIS GmbH lists its address in Munich, Germany. | Cologne, Germany |
| Intended users | The maker describes CYMETRIS Lite as suitable for freelance security engineers, consultancies, mobility and vehicle-development startups, automotive supply-chain security teams, and service providers running TARAs. | The maker describes Threagile as developer-friendly threat modeling for agile projects and DevSecOps workflows. |
| Purpose | CYMETRIS is a software platform for cyber risk analysis and TARA across the product lifecycle. | Threagile is an open-source toolkit for agile threat modeling that models architecture and assets in YAML and checks models against risk rules. |
| Support | Lite support is ticket-based with responses within less than one week; Enterprise includes priority support with a dedicated contact and SLA. | The repository invites users to create a GitHub discussion or issue, where contributors may respond. |
Plans
In their own words
CYMETRIS
CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.
Threagile
Threagile is an open-source toolkit for agile threat modeling. It represents architecture and assets in YAML and checks those models against risk rules, then produces reports of potential risks and recommended mitigations. Mitigation status can be recorded in the YAML model so reports reflect current progress. The toolkit also generates data-flow diagrams and supports Excel and JSON output. Teams can run it from the command line, in Docker, or as a REST server. Models can be edited in developer IDEs and tracked in Git, while custom risk rules can be written as YAML scripts without compiling Go code. A web playground analyzes YAML models and links to schema and API resources; a GitHub Action can run the tool against a repository model file. Threagile is free under the MIT License and supports API, Linux, self-hosted, and web use. The project describes itself as developer-friendly for agile projects and DevSecOps workflows. Its repository says current UI attempts are not ready, and support requests can be raised as GitHub discussions or issues.