ThreatOpus
ThreatOpus combines threat modelling with security checks for pull requests, returning PASS, WARN, or FAIL decisions in a CI pipeline.
What ThreatOpus is
ThreatOpus combines threat modelling with security checks for pull requests, returning PASS, WARN, or FAIL decisions in a CI pipeline. Teams can describe a system, import its design from OpenAPI or Terraform, or link a GitHub repository to generate STRIDE threats and track mitigations. STRIDE is available on every plan, while Pro adds nine other threat modelling frameworks. Merge Guard evaluates pull requests against policy bundles and posts decisions with reasons to CI checks. Listed integrations include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI. Check outcomes can be sent to Slack and Microsoft Teams, and scoped API keys support custom pipeline steps or internal orchestration. Project settings let users control whether raw architecture input is stored, its retention period, and whether structured threat output remains afterward. Signed-in users can export their data as JSON and delete content they created. The Free plan lists 3 users, 1 team workspace, 5 threat modelling generations per month, 1 repository, 1 SCM or CI provider, and STRIDE. Starter costs £129.99/month. ThreatOpus says generated threats and mitigations do not replace professional assessment, penetration testing, or formal risk acceptance.
Good
- Threat modelling and PR security checks
- Imports OpenAPI or Terraform designs
- Integrates with listed SCM and CI providers
- Retention settings, export, and deletion controls
- Free plan includes STRIDE
Watch out
- Free plan limited to 3 users
- Free plan allows 5 generations monthly
- Starter costs £129.99 per month
- Generated threats do not replace professional assessment
Who it suits
ThreatOpus is aimed at security teams, security champions, and platform engineers who need governed threat models and clear merge decisions. Its outputs support security work but are not a substitute for professional assessment or formal risk acceptance.
Verdict
ThreatOpus connects threat modelling with policy-based pull request decisions and offers a free plan alongside paid options. Teams should treat generated threats and mitigations as support for, not a replacement for, professional security assessment.
Plans and prices
From ThreatOpus's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Starter | £129.99 a month | 15 users · 10 team workspaces · 50 threat modelling generations/month · 10 repositories · All SCM and CI providers · Email support · £129.99/month |
| Pro | £299.99 a month | 50 users · 25 team workspaces · 250 threat modelling generations/month · 50 repositories · 9 additional threat modelling frameworks · 8 hours expert consultation/month · Priority support · £299.99/month |
| Enterprise | Priced on request | Custom users and repositories · Unlimited workspaces and threat modelling generations · All SCM and CI providers · SSO · Priority support · Custom |
| Free | — | 3 users · 1 team workspace · 5 threat modelling generations/month · 1 repository · 1 SCM or CI provider · STRIDE · £0.00/month |
The facts
Each one read from ThreatOpus's own pages, with the date it was checked.
What it does
- API keys
- PR Security supports scoped API keys for custom pipeline steps or internal orchestration.checked 30 Sep 2026
- Assessment limitation
- ThreatOpus says generated threats and mitigations support security work but do not replace professional assessment, penetration testing, or formal risk acceptance.checked 30 Sep 2026
- Authentication
- Accounts use email verification and password policies, sessions use httpOnly cookies, and optional two-factor authentication is available in user settings.checked 30 Sep 2026
- Data export and deletion
- Signed-in users can export their data as JSON and delete content they created through Data controls.checked 30 Sep 2026
- Integrations
- Listed source control and CI integrations include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI.checked 30 Sep 2026
- Intended users
- ThreatOpus describes its intended users as security teams, security champions, and platform engineers seeking governed threat models and clear merge decisions.checked 30 Sep 2026
- Methodologies
- STRIDE is available on every plan, while Pro adds nine additional threat modelling frameworks.checked 30 Sep 2026
- Notifications
- ThreatOpus can send check outcome notifications to Slack and Microsoft Teams.checked 30 Sep 2026
- Product
- ThreatOpus combines threat modelling with pull request security checks that return PASS, WARN, or FAIL outcomes in a CI pipeline.checked 30 Sep 2026
- PR security
- Merge Guard evaluates pull requests against policy bundles and returns decisions with reasons posted to CI checks.checked 30 Sep 2026
- Retention controls
- Project settings let users choose whether raw architecture input is stored, set its retention period, and decide whether structured threat output remains after raw input expires.checked 30 Sep 2026
- Subprocessors
- ThreatOpus says it does not sell personal data and that customers can request a subprocessor list for security review.checked 30 Sep 2026
- Support
- The pricing page lists email support on Starter and Pro, and priority support on Pro and Enterprise.checked 30 Sep 2026
- Threat modelling
- Teams can describe a system, import from OpenAPI or Terraform, or link a GitHub repository to generate STRIDE threats and track mitigations.checked 30 Sep 2026
Alternatives to ThreatOpus
- 1
Dethernety
Free planOpen sourceWebAPISelf-hosted7.2Free plan - 2
ThreatModeler Nexus
Free planWebAPISelf-hosted6.7From $4,000 a year - 3
ThreatTree
Free planWebAPI6.6From $29 a month - 4
OWASP Threat Dragon
Free planWebLinuxmacOSSelf-hosted6.4Free plan - 5
CAIRIS
Free planWebAPILinuxmacOS6.3Free plan - 6
ThreatForge
Free planWebLinuxmacOSWindows6.3Free plan