OWASP Threat Dragon vs pytm

OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.

pytm is a free, open-source Python framework for creating threat models from architectural descriptions. A model is defined in Python with elements such as servers, data stores, actors, processes, data flows, and trust boundaries. From it, pytm can generate data flow diagrams, sequence diagrams, and relevant threats. Templates can produce reports with diagrams and findings, and a RevealMD template can create slides for browser presentation. Data flow diagrams use Graphviz DOT, while sequence diagrams use PlantUML. Models can be imported from JSON with pytm's Python load function. Users can supply a custom threats file and change finding attributes such as CVSS score, response text, and severity. Requirements include Python 3.11 or later, Graphviz, Java OpenJDK 10 or 11, and plantuml.jar; Linux and macOS are listed, while Windows use is documented through Devbox in WSL. The project also documents container and Devbox dependency workflows. The README warns that strings in threats.json are evaluated with eval(), so the file's permissions need protection against unauthorized changes.