Threagile

Threagile is a free, open-source threat-modeling toolkit for teams that treat architecture as code. It suits developer-led Agile and DevSecOps groups comfortable maintaining YAML in Git, while organizations that expect a polished visual editor should choose another approach. Its core advantage is repeatable, automatable analysis; its main compromise is making YAML the primary working surface.

Overview

Threagile describes architecture and assets in YAML and evaluates those models against risk rules. That places security analysis alongside normal engineering changes, so a revised model can be reviewed and compared just like other repository content. The method is a strong fit for teams already using version control and code review, but it adds a learning and maintenance burden for stakeholders who prefer drawing diagrams directly.

The project identifies its current UI attempts as unfinished. A playground can analyze YAML and provide links to schema and API resources, yet it does not turn the product into a visual-first application. Teams should therefore select Threagile for its developer workflow, not for an out-of-the-box graphical experience.

Key features

Risk analysis and remediation

The toolkit produces risk reports that identify potential problems and suggest mitigation actions. It also generates data-flow diagrams automatically and exports results in formats including Excel and JSON, making findings easier to circulate beyond the engineering team. Mitigation status can be stored in the YAML model itself, allowing later reports to show whether risks remain open or have been addressed. This supports ongoing risk ownership rather than a one-time workshop deliverable.

Automation and extensibility

Threagile runs on the command line, in Docker, or as a REST server. A GitHub Action can execute it against a model file in a repository, which suits pull-request or pipeline checks. Custom risk rules are written as YAML scripts without compiling Go code, so teams can adapt policy checks without building a new software toolchain. The trade-off is that users must be willing to design and maintain models and rules in text.

Version-controlled modeling

Models are editable in developer IDEs and diffable in Git. That makes architectural changes visible in review and gives teams a practical history of how security assumptions evolved. It is more useful for collaborative engineering than for casual, diagram-only assessments, where the text-based representation may feel indirect.

Pricing

Threagile costs free under the Threagile plan. It is an open-source toolkit under the MIT License, with no paid tier or usage charge described. That makes the complete tool suitable for teams that can operate their own workflow and support it internally. The price does not remove the cost of adopting YAML conventions, integrating execution into pipelines, or maintaining custom rules.

Platforms

Deployment is both hosted and self-managed in the sense that the toolkit is offered through an API and web playground while also supporting Linux and self-hosted operation. Command-line, Docker, and REST-server execution gives infrastructure teams several ways to place analysis near their code. Teams wanting a finished desktop application or a ready-made, polished browser editor should account for the unfinished UI direction.

Who it's for

Threagile is best for developers, architects, and security engineers running Agile projects or DevSecOps pipelines who want threat models versioned with source code. It is particularly compelling when automated checks, Git diffs, and repository-based remediation tracking matter more than visual authoring. It is a weaker choice for nontechnical workshops, teams unwilling to maintain YAML, or organizations that require a mature graphical interface for broad business participation.

Pros and cons

• Pros: Free MIT-licensed software with no stated usage fee; risk reports include recommended mitigations; data-flow diagrams and Excel/JSON exports help share results; mitigation state stays with the YAML model; command-line, Docker, REST, and GitHub Action execution support automation; YAML custom rules avoid compiling Go code; Git-diffable models fit code review.
• Cons: The unfinished UI makes YAML central to everyday work; visual-first users may find model creation and review less approachable; teams must provide their own operational support through project discussions or issues; adopting custom rules and repository automation still requires engineering ownership.

Alternatives

CAIRIS is another free, open-source option with Apache licensing and broader desktop coverage, including macOS and Windows, if cross-platform access matters. OWASP Threat Dragon is free and open source with no stated paid plans or usage limits, making it a straightforward alternative for teams wanting a different modeling workflow.

ThreatForge offers a free Apache 2.0 application with no account requirement. pytm is a free open-source choice for teams aligned with OWASP’s nonprofit security community. ThreatModeler Nexus provides a free Community Edition for practitioners and teams evaluating a path to paid licensing.

ThreatOpus is a hosted freemium alternative with a Starter plan at £129.99 a month, 15 users, 10 workspaces, 50 generations monthly, and 10 repositories. ThreatTree has a free tier capped at three forests, three DFDs per forest, and five attack trees per DFD, with Pro at $29 per user monthly. AWS Threat Composer is a free option available across web, desktop, extension, and self-hosted environments.

Verdict

Choose Threagile if your team wants MIT-licensed, developer-oriented threat modeling that can live in YAML, Git, and CI pipelines while producing actionable reports. Look elsewhere if broad participation depends on a finished visual interface or if you do not want to own model and rule maintenance. For engineering-led security programs, its automation and traceable remediation outweigh that workflow constraint.