pytm vs ThreatZ

pytm is a free, open-source Python framework for creating threat models from architectural descriptions. A model is defined in Python with elements such as servers, data stores, actors, processes, data flows, and trust boundaries. From it, pytm can generate data flow diagrams, sequence diagrams, and relevant threats. Templates can produce reports with diagrams and findings, and a RevealMD template can create slides for browser presentation. Data flow diagrams use Graphviz DOT, while sequence diagrams use PlantUML. Models can be imported from JSON with pytm's Python load function. Users can supply a custom threats file and change finding attributes such as CVSS score, response text, and severity. Requirements include Python 3.11 or later, Graphviz, Java OpenJDK 10 or 11, and plantuml.jar; Linux and macOS are listed, while Windows use is documented through Devbox in WSL. The project also documents container and Devbox dependency workflows. The README warns that strings in threats.json are evaluated with eval(), so the file's permissions need protection against unauthorized changes.

ThreatZ is an automotive cybersecurity management platform for OEMs and Tier-1 suppliers tracking vehicle security and supply-chain evidence. It brings TARA, software bills of materials, attack paths, incidents and compliance evidence into a knowledge graph. Threat modeling supports STRIDE TARA, AI-assisted threat scenarios and attack paths with feasibility ratings. ThreatZ generates work products for ISO/SAE 21434, UN R155 and GB 44495-2024; the last requires PRC-region deployment. Its integration list includes more than 30 tools and formats, among them Vector CANoe, MATLAB System Composer, Jira, GitHub and SonarQube. Data interchange options include ReqIF, SARIF, OpenXSAM, STIX, AUTOSAR, PDF, CSV and Excel. Team and Professional are hosted AWS Marketplace subscriptions, while Enterprise supports private cloud, on-premises and air-gapped deployment. The listed Team plan costs $1,199 a year, billed annually, and allows up to three projects. Professional is listed at $499 a year, billed annually, for 5–50 users and up to 15 projects; Enterprise is $100 a year with custom billing and unlimited projects and users. A free four-week trial uses sample vehicle data; Professional and Enterprise trials require approval.