OWASP Threat Dragon

OWASP Threat Dragon is an open-source threat-modeling application for developers and defenders, from beginners to experienced modelers. Its strongest fit is teams that want structured threat analysis while choosing between local desktop work and a self-hosted web deployment.

Overview

Threat Dragon combines system diagrams with threat lists tied to diagram elements, making it useful for bringing threat modeling into a secure development lifecycle. Its range of frameworks and deployment choices is substantial for a free tool; the trade-off is volunteer maintenance, which means immediate incident investigation or response is not guaranteed.

Key features

Diagrams can map processes, data stores, actors, data flows and trust boundaries. A rule engine suggests threats and mitigations, including context-specific suggestions based on element properties. That gives teams a more structured starting point for reviewing risk than diagramming alone, though suggestions still need human assessment.

Threat categories include STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai. Risk prioritization, templates and multiple modeling methods support different approaches to analysis. The breadth is useful for teams with varied modeling practices, while organizations that need a guaranteed rapid support response should weigh the volunteer-maintenance limitation carefully.

The web app supports local file storage and configurable access to GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab. The desktop app saves models locally. This gives teams options to work with local files or connect web deployments to existing storage services.

Threat Dragon can run as a containerized, self-hosted web application or as a desktop app, with installers for Windows, macOS and Linux. The project says analytics are disabled by default, require server configuration, and do not collect threat-model content or Plausible usernames. It also reports signed commits, full-length SHAs for supply-chain actions, signed and notarized desktop releases where possible, and automated dependency, SAST, DAST and container scans on each commit. These practices are relevant to security-conscious adopters, but do not remove the stated limits on incident response.

Pricing

Free: free (billed Free, open source). The free plan has no paid plans or usage limits stated, making it a strong fit for individuals and teams that want threat modeling without a subscription. Apache License 2.0 is listed for the project. The free offering does not come with a guaranteed immediate incident response.

Platforms

Threat Dragon supports Linux, macOS, Windows, web and self-hosted use. Choose the desktop version for locally saved models, or deploy the containerized web application when a self-hosted team workflow is preferable.

Who it's for

Threat Dragon suits developers and defenders who want to build threat models as part of secure development, whether they are new to threat modeling or already experienced. It is particularly well matched to teams that value open-source software, framework choice and control over desktop or self-hosted deployment. It is a weaker fit where immediate incident response is a firm requirement.

Pros and cons

• Pro: Free and open source, with no usage limits stated, so teams can adopt it without a paid-plan cap.
• Pro: Multiple threat frameworks and context-aware threat and mitigation suggestions support structured analysis across different modeling approaches.
• Pro: Desktop, web and self-hosted deployment plus local and configurable storage options give teams meaningful control over where models live.
• Con: Volunteer maintenance means immediate investigation or response to incidents is not always possible.

Alternatives

Compare more threat-modeling software if you want to consider the category broadly.

• CAIRIS is another free Apache-licensed option, with API, desktop, web and self-hosted platforms.
• ThreatOpus is a freemium alternative with a free trial and a Starter plan at £129.99 a month.
• IriusRisk offers a free Community Edition for one user with limited collaboration and up to three active threat models.
• ThreatModeler Nexus has a free Community Edition for practitioners and teams who want to experience threat modeling before scaling.
• ThreatTree is a freemium option whose free plan caps users at three forests, three DFDs per forest and five attack trees per DFD.
• AWS Threat Composer is another free threat-modeling option.
• CYMETRIS is a paid alternative starting with CYMETRIS Lite at €99 a month.
• ThreatZ is a paid alternative with a free trial.

Verdict

Choose OWASP Threat Dragon if you want free, open-source threat modeling with diagram-linked suggestions and the option to work on desktop or self-host the web app. Its main reason to look elsewhere is the volunteer support model: teams that require assured immediate incident response should consider another fit.