OWASP Threat Dragon vs TSpec
OWASP Threat Dragon
threatdragon.comTSpec
github.comSide by side
| Figure | OWASP Threat Dragon | TSpec |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 0 |
| Spec score · Threat Modeling Software | 7.9 (#6) | 6.2 (#21) |
| Intended users | OWASP describes Threat Dragon as intended for developers and defenders, and says both experienced threat modelers and beginners can use it. | The project describes itself as designed specifically for TypeScript developers. |
| License | The OWASP project page lists the license as Apache License 2.0. | The repository identifies the project as MIT licensed. |
| Purpose | Threat Dragon creates threat model diagrams and lists threats for diagram elements as part of a secure development lifecycle. | TSpec is a TypeScript-first testing framework for testing TypeScript applications. |
Plans
In their own words
OWASP Threat Dragon
OWASP Threat Dragon creates threat-model diagrams and records threats associated with diagram elements as part of a secure development lifecycle. Diagrams can represent processes, data stores, actors, data flows and trust boundaries. It supports STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai threat categories. A rule engine can propose threats and mitigations based on properties of diagram elements. Threat Dragon can run as a containerized, self-hosted web application or as a desktop app with installers for Windows, macOS and Linux. The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab; the desktop app saves models locally. The project lists Apache License 2.0. Analytics are disabled by default and require server configuration. The project is volunteer-maintained and notes that immediate investigation or response to incidents is not always possible. Threat Dragon is listed at free, with no paid plans or usage limits stated.