ThreatForge

Overview

ThreatForge is an open-source app for building threat models with diagrams and automated STRIDE analysis. It is best suited to developers and teams who want a lightweight way to model threats without an enterprise procurement process. The trade-off is that AI assistance requires a user-provided API key.

Key features

The visual canvas offers 44 typed components across 10 categories, with trust boundaries, annotations and automatically routed connections. Six templates cover cloud microservices, e-commerce, mobile banking, SaaS, IoT smart buildings and healthcare systems, giving teams a starting point for common architectures rather than a blank canvas.

ThreatForge’s rule engine derives STRIDE threats from component types and data flows, and works offline. That makes its core analysis usable without sending a model to an AI service; it is rule-based, rather than a substitute for judgment about system-specific risks. Optional Claude or GPT chat can suggest threats and mitigations or answer security questions, but requires your own API key.

Models are stored as human-readable YAML, so teams can version them and review changes in pull requests. The maker says models stay on the user’s machine and the app has no telemetry. No account is needed to start. The download is described as approximately 10 MB.

Pricing

Threat Forge costs nothing. The Apache 2.0 application is available in full, with no freemium upsells or enterprise-only features. There is no free trial because the software is free. The main caveat is that AI analysis requires a user-provided API key; the core rule-based STRIDE analysis works offline.

Platforms

ThreatForge supports Linux, macOS, Windows and the web. Its deployment is categorized as cloud, so readers choosing a desktop app should confirm which experience fits their workflow.

Who it's for

ThreatForge fits developers and teams who want visual threat modeling, offline STRIDE analysis and version-controlled model files without enterprise procurement. It is less suitable for anyone who needs AI assistance without supplying an API key or expects the rule engine alone to resolve nuanced security decisions.

Pros and cons

Pros

• Full app is free and open source. Apache 2.0 licensing and no enterprise-only features avoid a paid tier as a prerequisite for core capabilities.
• Offline STRIDE analysis. The rule engine works from components and data flows without relying on AI services.
• Reviewable models. Human-readable YAML makes changes suitable for version history and pull-request review.
• Useful starting points. Six templates span cloud, commerce, mobile, SaaS, IoT and healthcare scenarios.

Cons

• AI has an extra requirement. Claude or GPT assistance depends on a user-provided API key.
• Analysis is rule-based at its core. Threat generation uses element types and data-flow patterns, so teams still need to assess context-specific risks.

Alternatives

Threat Modeling Software is the broader category directory for comparing tools. CAIRIS is another free, Apache-licensed option across desktop, web, API and self-hosted platforms. OWASP Threat Dragon is also free and open source, with no paid plans or usage limits stated, and supports desktop, web and self-hosted use.

ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects and security teams to try threat modeling before scaling. ThreatOpus may suit teams looking for a paid team-workspace and repository workflow: its Starter plan is £129.99 a month for 15 users, 10 team workspaces, 50 threat-modeling generations per month and 10 repositories.

ThreatTree suits users who want a free, capped structure: its Free plan allows up to 3 forests, 3 DFDs per forest and 5 attack trees per DFD; Pro is $29 a month per user. AWS Threat Composer is another free option across desktop, web, API and self-hosted platforms. IriusRisk offers a free Community Edition capped at 3 active models and one user with limited collaboration. itemis SECURE is a paid alternative for web and Windows users, with named-user or floating licenses.

Verdict

Choose ThreatForge if you want a free, open-source threat-modeling app whose offline STRIDE engine and diffable YAML models fit a developer workflow. Its strongest reason to choose it is the combination of accessible visual modeling and reviewable files without an enterprise gate. Look elsewhere if AI-assisted analysis without your own API key is essential, or if you need capabilities beyond rule-generated threats.