OWASP Threat Dragon vs ThreatZ

OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.

ThreatZ is an automotive cybersecurity management platform for OEMs and Tier-1 suppliers tracking vehicle security and supply-chain evidence. It brings TARA, software bills of materials, attack paths, incidents and compliance evidence into a knowledge graph. Threat modeling supports STRIDE TARA, AI-assisted threat scenarios and attack paths with feasibility ratings. ThreatZ generates work products for ISO/SAE 21434, UN R155 and GB 44495-2024; the last requires PRC-region deployment. Its integration list includes more than 30 tools and formats, among them Vector CANoe, MATLAB System Composer, Jira, GitHub and SonarQube. Data interchange options include ReqIF, SARIF, OpenXSAM, STIX, AUTOSAR, PDF, CSV and Excel. Team and Professional are hosted AWS Marketplace subscriptions, while Enterprise supports private cloud, on-premises and air-gapped deployment. The listed Team plan costs $1,199 a year, billed annually, and allows up to three projects. Professional is listed at $499 a year, billed annually, for 5–50 users and up to 15 projects; Enterprise is $100 a year with custom billing and unlimited projects and users. A free four-week trial uses sample vehicle data; Professional and Enterprise trials require approval.