CYMETRIS vs ThreatTree
CYMETRIS
cymetris.comThreatTree
threattree.comSide by side
| Figure | CYMETRIS | ThreatTree |
|---|---|---|
| Price from | €99/mo | $29/mo |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 2 | 3 |
| Spec score · Threat Modeling Software | 7.9 (#5) | 7.7 (#9) |
| Headquarters | CYMETRIS GmbH lists its address in Munich, Germany. | United Kingdom |
| Integrations | The public API is intended to connect CYMETRIS with external requirements, architecture, PLM, ticketing, ALM, and reporting systems. | The Enterprise plan lists custom Jira and ServiceNow ticketing, Terraform/OpenAPI architecture import, Splunk and Microsoft Sentinel feeds, GRC platform sync, and Confluence/Notion embeds. |
| Intended users | The maker describes CYMETRIS Lite as suitable for freelance security engineers, consultancies, mobility and vehicle-development startups, automotive supply-chain security teams, and service providers running TARAs. | ThreatTree describes itself as a browser-based tool for security teams ranging from solo consultants to CISO organizations. |
| Purpose | CYMETRIS is a software platform for cyber risk analysis and TARA across the product lifecycle. | ThreatTree organizes threat models into forests containing Data Flow Diagrams and Attack Trees. |
| Support | Lite support is ticket-based with responses within less than one week; Enterprise includes priority support with a dedicated contact and SLA. | The pricing page lists priority support with Pro and dedicated support and an SLA with Enterprise. |
Plans
In their own words
CYMETRIS
CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.
ThreatTree
ThreatTree is a browser-based tool for organizing threat models into forests of Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then generates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK; mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. Teams can invite members with owner, editor, or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan, including Free. ThreatTree says data is stored on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are taken daily and retained for 30 days. The Free plan costs nothing and has limits on forests and trees. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote.