OWASP Threat Dragon vs ThreatTree

OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.

ThreatTree is a browser-based tool for organizing threat models into forests of Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then generates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK; mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. Teams can invite members with owner, editor, or viewer roles. Reports are available as PDFs, with JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan, including Free. ThreatTree says data is stored on UK servers, connections use TLS 1.2 or higher, and encrypted database backups are taken daily and retained for 30 days. The Free plan costs nothing and has limits on forests and trees. Pro costs $29 a month per user, billed monthly; Enterprise pricing is by quote.