EnCo SOX ATA vs OWASP Threat Dragon
EnCo SOX ATA
enco-software.comOWASP Threat Dragon
threatdragon.comSide by side
| Figure | EnCo SOX ATA | OWASP Threat Dragon |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 0 | 1 |
| Spec score · Threat Modeling Software | 7.5 (#14) | 7.9 (#6) |
| Intended users | EnCo describes SOX as a safety and security engineering workbench for multidisciplinary engineering teams and says the company serves automotive, plant engineering, rail, and aerospace industries. | OWASP describes Threat Dragon as intended for developers and defenders, and says both experienced threat modelers and beginners can use it. |
| Purpose | ATA is a top-down method for identifying attack paths from a point of attack to a threat and analyzing those paths. | Threat Dragon creates threat model diagrams and lists threats for diagram elements as part of a secure development lifecycle. |
| Support | SOX and licensing queries are handled through EnCo’s Service Desk, which requires registration and active customer status. | The project directs users to its mailing list, OWASP Slack channel, GitHub issues and public discussions for questions, bugs and feature requests. |
Plans
In their own words
EnCo SOX ATA
EnCo SOX ATA is an attack tree analysis module in the SOX engineering workbench. It models hierarchical attack paths with logical AND and OR gates and links those trees to TARA threat scenarios. Users score attack steps against feasibility criteria; the module propagates scores through the tree to calculate threat or attack-feasibility levels according to the selected norm and expose critical paths. Threats can move between TARA and ATA, with paths linked by drag and drop. Reusable attack paths can be placed elsewhere in a tree or another analysis. The module connects requirements, system design, TARA and cybersecurity goals, while trace views show requirement relationships and assets can be assigned to elements. Teams can assign tasks, set statuses, track progress and review changes through a central database. Outputs include printed or image-exported diagrams, Excel results and Report Designer documentation. It runs on web and Windows; pricing is on request.
OWASP Threat Dragon
OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.