
Dethernety
Dethernety is an open-source threat modeling platform that represents architecture as a graph.
What Dethernety is
Dethernety is an open-source threat modeling platform that represents architecture as a graph. Teams can build and explore models in a browser, from code, or from reports, then examine attack paths, blast radius, and residual risk across the architecture. Exposures map to MITRE ATT&CK techniques, while controls map to D3FEND countermeasures for identifying coverage gaps. JavaScript and TypeScript modules cover design, analysis, and issues, alongside an OPA/Rego policy engine. Issue modules can connect to external trackers and synchronize remediation issues in both directions. Users host their own graph database, with Neo4j and Memgraph listed as options. Analysis can use deterministic queries, single-agent AI acceleration, or multi-agent LangGraph workflows. The open-source edition runs on infrastructure users control and can operate offline without cloud calls. The maker says models, data, and findings stay on that infrastructure and that the platform sends no background telemetry. The GUI is aimed at security teams; the CLI supports DevOps automation and threat-model-as-code. Enterprise includes dedicated support and deployment help. Hosted SaaS is planned for later, and package composition and pricing remain in progress.
Good
- Models can be built in a browser, from code, or reports.
- Maps exposures to MITRE ATT&CK and controls to D3FEND.
- Can operate offline without cloud calls.
- Issue modules sync remediation issues bidirectionally.
- Free open-source edition is self-hosted.
Watch out
- Users must host their own graph database.
- Hosted SaaS is planned for later.
- Package composition and pricing are still being finalized.
Who it suits
Dethernety suits security teams modeling system architecture and DevOps teams using threat-model-as-code or CI/CD automation. It is a fit for organizations prepared to host their own graph database and infrastructure.
Verdict
Dethernety combines graph-based threat analysis with self-hosted operation and multiple analysis approaches. Teams should account for hosting their own graph database and the fact that Hosted SaaS is not yet available.
Plans and prices
From Dethernety's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open Source | Free | Full platform · self-hosted · bring your own graph database · offline-capable |
| BYODt | Priced on request | Self-hosted · cloud-served specialized modules · closed-vocabulary attributes only leave your network · Pricing being finalized |
| BYODt Team — 5 or 20 seats | Priced on request | 5 or 20 seats · self-hosted · shared package access · Pricing being finalized |
| Enterprise | Priced on request | Self-hosted · own identity provider · air-gap-friendly · dedicated support · By contract |
| Hosted SaaS | Priced on request | Per-customer isolated managed deployment · separate network, identity, storage and compute · Planned later |
The facts
Each one read from Dethernety's own pages, with the date it was checked.
What it does
- AI analysis
- Analysis options include deterministic queries, single-agent AI acceleration, and multi-agent LangGraph workflows.checked 8 Oct 2026
- Analysis engines
- Analysis can use deterministic queries, single-agent AI acceleration or multi-agent LangGraph workflows.checked 15 Oct 2026
- Availability limits
- BYODt and BYODt Team are described as coming soon, while Hosted SaaS is planned for later; package composition and pricing are still being finalized.checked 8 Oct 2026
- Claude Code integration
- The Dethereal Claude Code plugin provides 14 slash commands, 5 specialized agents and 22 MCP tools.checked 15 Oct 2026
- CLI workflow
- The CLI supports CI/CD automation and threat-model-as-code with version control.checked 15 Oct 2026
- Container quickstart
- The BYODt deployment requires Docker with Compose or Podman 4.1 or newer and runs from signed images.checked 15 Oct 2026
- Data handling
- The maker says models, data, and findings stay on the user's infrastructure; optional cloud evaluations send only closed-vocabulary configuration attributes and discard the payloads.checked 8 Oct 2026
- Deployment prerequisites
- The documented source setup requires Node.js 18 or newer, pnpm 9.13 or newer, Neo4j or Memgraph and an OIDC provider.checked 15 Oct 2026
- Deterministic analysis
- The platform computes exposures, controls and attack paths from the model and links findings to evidence.checked 15 Oct 2026
- Documentation
- The repository includes user guides, architecture documentation, configuration guidance, security-model documentation and module-development documentation.checked 15 Oct 2026
- Evidence sources
- Module findings cite sources including CVE, NIST 800-53, CWE, CIS, MITRE ATT&CK and D3FEND.checked 15 Oct 2026
- File portability
- Models can be exported as JSON or split-file ZIPs, versioned with code, edited offline and re-imported.checked 15 Oct 2026
- Graph databases
- The platform names Neo4j and Memgraph as graph database options, and users host their own graph database.checked 8 Oct 2026
- Graph queries
- Attack paths, blast radius and chokepoints are analyzed as graph operations rather than table joins.checked 15 Oct 2026
- Graph storage
- Models are stored as graph structures in Neo4j or Memgraph, with components, flows, boundaries and controls represented as nodes and relationships.checked 15 Oct 2026
- Independent directory description
- Toreon describes Dethernety as a visual graph-native threat-modeling tool that analyzes architectural attack paths and produces MITRE-mapped findings.checked 15 Oct 2026
- Independent directory listing
- Toreon's threat-modeling directory lists Dethernety as a 2026 personal release by Velnomix, active, AI-capable and AGPL-3.0-only.checked 15 Oct 2026
- Integrations
- Issue modules can connect with external trackers and sync remediation issues bidirectionally.checked 8 Oct 2026
- Intended users
- The maker describes the GUI for security teams and the CLI for DevOps teams, with the CLI supporting CI/CD automation and threat-model-as-code.checked 8 Oct 2026
- Issue management
- Findings can create issues and synchronize remediation with external trackers through issue modules.checked 15 Oct 2026
- License
- The public repository is licensed GNU Affero General Public License version 3.0, AGPL-3.0-only.checked 15 Oct 2026
- Limit: no attacker model
- Threat Report says it shows reachability routes but does not model attacker effort, credential reuse or exploit chaining.checked 15 Oct 2026
- Limit: not a live scan
- Threat Report explicitly says its coverage is modelled or design-asserted and is not telemetry from a running system.checked 15 Oct 2026
The company
- Company founder
- Levente Simon is identified as Dethernety's founder and creator, with more than 25 years in strategy, leadership, architecture and software development.checked 15 Oct 2026
Alternatives to Dethernety
- 1

ThreatModeler Nexus
Free planWebAPISelf-hosted6.7From $4,000 a year - 2

ThreatOpus
Free planWebAPI6.7From £129.99 a month - 3
ThreatTree
Free planWebAPI6.6From $29 a month - 4
OWASP Threat Dragon
Free planWebLinuxmacOSSelf-hosted6.4Free plan - 5
CAIRIS
Free planWebAPILinuxmacOS6.3Free plan - 6
ThreatForge
Free planWebLinuxmacOSWindows6.3Free plan
