OWASP Threat Dragon vs ThreatModeler Nexus

OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.

ThreatModeler Nexus is an agentic platform for secure design and governed threat modeling across applications, cloud and hybrid architectures, devices, and operational technology. Its Secure Design Graph connects architectures, threats, controls, compliance requirements, and security decisions. System Mapping, Graph, and Reporting agents operate on that graph. Supported methods include STRIDE, PASTA, and CSA MAESTRO for agentic systems, and findings map to more than 180 regulatory and security frameworks, including NIST, ISO 27001, PCI DSS, HIPAA, DORA, and the EU AI Act. A built-in MCP Server checks pull requests and commits against the current threat model and returns threats, requirements, and mitigations in developer workflows. Integrations include infrastructure tools, cloud providers, code platforms, ServiceNow, and ArmorCode. Customers can connect their own AI model, with a deterministic framework governing output. Web, API, and self-hosted environments are listed. A free Community Edition is available; the ThreatModeler license costs $4,000 a year on a 12-month contract. Additional AWS infrastructure costs may apply.