CYMETRIS vs ThreatZ
CYMETRIS
cymetris.comThreatZ
threatz.ioSide by side
| Figure | CYMETRIS | ThreatZ |
|---|---|---|
| Price from | €99/mo | $8.33/mo |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 3 |
| Spec score · Threat Modeling Software | 7.9 (#5) | 7.6 (#12) |
| Headquarters | CYMETRIS GmbH lists its address in Munich, Germany. | Regensburg, Germany |
| Integrations | The public API is intended to connect CYMETRIS with external requirements, architecture, PLM, ticketing, ALM, and reporting systems. | The integrations page lists 30+ tools and data formats, including Vector CANoe, MATLAB System Composer, Jira, GitHub, and SonarQube. |
| Security | The maker says its cloud service uses server locations in Germany, offers on-premise deployment, and is GDPR compliant. | ThreatZ is TISAX AL3 assessed; its trust page says ISO 27001 alignment is on the roadmap. |
| Support | Lite support is ticket-based with responses within less than one week; Enterprise includes priority support with a dedicated contact and SLA. | The trust page says ThreatZ has offices and support in Germany, the United States, and Egypt, and commits to responding to vulnerability reports within 48 hours. |
Plans
In their own words
CYMETRIS
CYMETRIS is a cyber risk analysis and TARA platform for work across a product lifecycle. Its guided workflow follows ISO/SAE 21434 and applies automated consistency and logic checks. Teams can inspect attack paths interactively and map risks to components in system architecture, with risk prioritization, collaborative review, templates, frameworks, and multiple modeling methods. CYMETRIS Lite generates audit-ready reports for ISO/SAE 21434 and UN R155. The maker describes AI assistance through MCP for importing architectures, identifying assets, developing attack vectors, and querying TARA datasets in natural language. A public API is intended to connect requirements, architecture, PLM, ticketing, ALM, and reporting systems. Vulnerabilities can be imported from CVE databases, vendor advisories, or internal analyses and mapped to affected components; this capability is described as a selected-customer prototype. Access is available through web, API, or self-hosted deployment. Lite costs €99.00 per month, includes one full TARA project, and allows up to five active projects.
ThreatZ
ThreatZ is an automotive cybersecurity management platform for OEMs and Tier-1 suppliers tracking vehicle security and supply-chain evidence. It brings TARA, software bills of materials, attack paths, incidents and compliance evidence into a knowledge graph. Threat modeling supports STRIDE TARA, AI-assisted threat scenarios and attack paths with feasibility ratings. ThreatZ generates work products for ISO/SAE 21434, UN R155 and GB 44495-2024; the last requires PRC-region deployment. Its integration list includes more than 30 tools and formats, among them Vector CANoe, MATLAB System Composer, Jira, GitHub and SonarQube. Data interchange options include ReqIF, SARIF, OpenXSAM, STIX, AUTOSAR, PDF, CSV and Excel. Team and Professional are hosted AWS Marketplace subscriptions, while Enterprise supports private cloud, on-premises and air-gapped deployment. The listed Team plan costs $1,199 a year, billed annually, and allows up to three projects. Professional is listed at $499 a year, billed annually, for 5–50 users and up to 15 projects; Enterprise is $100 a year with custom billing and unlimited projects and users. A free four-week trial uses sample vehicle data; Professional and Enterprise trials require approval.