DevArmor vs OWASP Threat Dragon
DevArmor
devarmor.comOWASP Threat Dragon
threatdragon.comSide by side
| Figure | DevArmor | OWASP Threat Dragon |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Threat Modeling Software | 7.5 (#13) | 7.9 (#6) |
| Intended users | The maker describes the product as serving security teams, developers, and coding agents in software development workflows. | OWASP describes Threat Dragon as intended for developers and defenders, and says both experienced threat modelers and beginners can use it. |
Plans
In their own words
OWASP Threat Dragon
OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.