IriusRisk

IriusRisk is a threat-modeling platform for designing secure software, with AI-assisted diagram creation and compliance guidance. It best suits security, development, and compliance teams that need to connect threat analysis with established workflows. Its free edition makes it approachable for individual use, but strict model and user caps—and a cloud restriction on sensitive data—make plan and deployment choices important.

Overview

IriusRisk helps teams build threat models, identify threats and countermeasures, and surface vulnerabilities and compliance gaps. Risk prioritization and collaborative review support moving from identifying risks to discussing and managing them. Multiple modeling methods and templates give teams ways to structure that work rather than starting from a blank page.

Jeff AI Assistant can turn user stories, documentation, meeting transcripts, or code into a threat-model diagram with threats and security controls. That can help teams translate existing project material into a model, though the Community Edition's one-user limit constrains collaboration on the free plan.

Key features

Threat modeling and compliance

The knowledge base supports applying PCI DSS, NIST, and GDPR standards to threat models, and marks aligned countermeasures as required. This gives compliance teams a direct way to bring those standards into modeling; it does not remove the need to assess whether the model fits the team's compliance work.

Diagrams and integrations

Users can import diagrams from draw.io, Visio, Lucidchart, and Microsoft Threat Modeling Tool, which can help teams carry existing diagrams into their threat-modeling workflow. Integrations include Jira, ServiceNow, Azure DevOps, Jenkins, GitHub, OWASP ZAP, Terraform, AWS CloudFormation, and Open API. That breadth is useful for organizations already working with these tools.

Security and data handling

IriusRisk holds ISO/IEC 27001 certification and says it maintains independently audited controls. Its stated measures include encryption in transit and at rest, access controls, regular penetration testing, and incident response procedures. However, its cloud services are not designed or certified to process PHI, specially treated financial data, IDs, or GDPR special category data. Teams handling those categories should not assume the cloud service is suitable; Enterprise is offered on-premise as well as SaaS.

Pricing

IriusRisk uses a freemium model. Community Edition costs nothing and includes three active threat models, one user with limited collaboration, templates and libraries, XML diagram export, and technical and compliance reports. That is a useful no-cost starting point for an individual, but the three-model cap and single seat make it a poor fit for a team that needs ongoing shared work.

Enterprise has custom pricing and is available as SaaS or on-premise. It includes purchased threat models with no maximum, unlimited users, configuration, OpenAPI, a dedicated Customer Success Manager, and enterprise onboarding. The absence of a model ceiling and user limit makes it the more suitable tier for broader organizational use; teams should weigh the custom-price commitment and choose deployment with the sensitive-data restriction in mind. There is no free trial.

Standard, Gold, and Platinum support plans offer varying availability, response times, and support channels. The distinctions between tiers matter to teams with specific support needs, but no support tier should be assumed from the plan names alone.

Platforms

IriusRisk is available through web, API, and self-hosted deployments. Enterprise customers can choose SaaS or on-premise deployment, giving organizations a deployment option beyond the cloud service. The sensitive-data restriction remains an important consideration for cloud users.

Who it's for

IriusRisk is aimed at security teams, developers, CISOs, and compliance teams. It is a strong fit for organizations that want threat modeling tied to compliance standards, diagram imports, and development and infrastructure integrations. Individuals can use Community Edition to begin with a small number of models; teams needing shared access or more than three active models should consider Enterprise. Organizations processing the sensitive data excluded from IriusRisk's cloud services should look carefully at on-premise deployment or another tool.

Pros and cons

• Pros: The AI assistant can generate threat-model diagrams from several kinds of project material, including user stories, transcripts, and code.
• Pros: Standards guidance, required countermeasures, risk prioritization, and collaborative review bring compliance and risk work into the modeling process.
• Pros: Diagram imports and integrations with development, ticketing, security, and infrastructure tools can fit into established workflows.
• Cons: Community Edition is limited to one user and three active threat models, so it is a constrained option for team use.
• Cons: Cloud services are not designed or certified for several sensitive data categories, limiting their suitability for some organizations.
• Cons: Enterprise pricing is custom, so buyers cannot assess its cost from a published price.

Alternatives

Threat Modeling Software is the broader category directory for comparing tools. Choose CAIRIS if you want a free tool available under the Apache Software License, with desktop and self-hosted platforms as well as web and API access. ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects, and security teams to experience threat modeling before scaling; consider it for that stated entry point.

ThreatOpus is worth considering if you need a free trial or a defined monthly starter tier: its Starter plan is £129.99 a month, billed £129.99/month, and includes 15 users, 10 team workspaces, 50 threat modeling generations per month, 10 repositories, and all SCM and CI providers. Choose itemis SECURE if named-user or floating licensing is the relevant fit; its named license is tied to an individual, while floating licenses are shared up to the concurrent-user limit.

CYMETRIS is a paid option with a published Lite plan at €99 a month, billed net €99/month, including one full TARA project; additional projects cost net €899/year each, up to five active projects, with collaboration limited to two users. AWS Threat Composer is a free alternative if a free tool is the priority. ThreatTree offers a free tier capped at three forests, three DFDs per forest, and five Attack Trees per DFD, or a Pro plan at $29 a month billed per user monthly. OWASP Threat Dragon is a free, open-source alternative with no paid plans or usage limits stated.

Verdict

Choose IriusRisk if your security or compliance team wants threat modeling connected to standards, imported diagrams, and development workflows, and can work within Community Edition's limits or budget for Enterprise. Its main advantage is the combination of modeling, compliance guidance, and integrations; its main caution is the cloud service's sensitive-data restriction, alongside custom Enterprise pricing. Look elsewhere if those limits or deployment considerations do not fit your organization.