IriusRisk vs Threagile

IriusRisk is an AI threat-modeling tool for planning secure software design. It helps teams build threat models, identify threats and countermeasures, and surface vulnerabilities and compliance gaps. Its Jeff AI Assistant can turn user stories, documentation, meeting transcripts, or code into a diagram showing threats and security controls. A built-in knowledge base supports applying standards such as PCI DSS, NIST, and GDPR, marking aligned countermeasures as required. Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and Open API; users can also import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool. The free Community Edition costs nothing and allows one user and three active threat models. Enterprise has no listed price and is offered as SaaS or on-premise. IriusRisk says its cloud services are not designed or certified for certain sensitive data, including PHI and GDPR special category data.

Threagile is an open-source toolkit for agile threat modeling. It represents architecture and assets in YAML and checks those models against risk rules, then produces reports of potential risks and recommended mitigations. Mitigation status can be recorded in the YAML model so reports reflect current progress. The toolkit also generates data-flow diagrams and supports Excel and JSON output. Teams can run it from the command line, in Docker, or as a REST server. Models can be edited in developer IDEs and tracked in Git, while custom risk rules can be written as YAML scripts without compiling Go code. A web playground analyzes YAML models and links to schema and API resources; a GitHub Action can run the tool against a repository model file. Threagile is free under the MIT License and supports API, Linux, self-hosted, and web use. The project describes itself as developer-friendly for agile projects and DevSecOps workflows. Its repository says current UI attempts are not ready, and support requests can be raised as GitHub discussions or issues.