ThreatTree

Visit site Alternatives

Score6.9

Rank#6 of 22

From$29/mo

Free planYes

Runs onAPI, Web

Summary

ThreatTree is a browser-based threat-modeling tool that arranges work into forests containing Data Flow Diagrams and Attack Trees. It scores risks by likelihood and impact, then creates a ranked risk register across the trees in a forest. Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK, while mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2. The product supports owner, editor, and viewer roles for invited collaborators, PDF reports, and JSON and STIX 2.1 exports. Optional per-forest AES-256-GCM encryption is available on every plan. The Free plan costs 0.00 USD per free and allows up to three forests, three DFDs per forest, and five Attack Trees per DFD. Pro costs 29.00 USD per month per user, billed monthly. Enterprise pricing is by quote. ThreatTree says it is not currently SOC 2 or ISO 27001 certified.

Who it is for

ThreatTree is intended for security teams ranging from solo consultants to CISO organizations. It may suit teams that need structured threat models, risk prioritization, and collaborative review.

What is good

Ranks risks using likelihood and impact
Supports multiple threat frameworks and control standards
Offers PDF, JSON, and STIX 2.1 outputs
Optional per-forest encryption is available on every plan
Invited team members can have distinct roles

What to know first

Free plan limits forests and diagrams
Pro costs 29.00 USD per month per user
Enterprise pricing is by quote
Not currently SOC 2 or ISO 27001 certified

Verdict

ThreatTree combines structured modeling, risk ranking, and team review with multiple export formats. Its free plan has specific model limits, and the company says it does not currently hold SOC 2 or ISO 27001 certification.

ThreatTree plans and pricing

All plans

Free Free Up to 3 forests · Up to 3 DFDs per forest · Up to 5 Attack Trees per DFD threattree.com · 30 Sept 2026

Pro $29/mo per user, monthly Unlimited forests & trees · Team collaboration · Full report generation · Priority support threattree.com · 30 Sept 2026

Enterprise Not published Quote on request; pricing depends on org size & requirements SSO/SAML · Custom roles and data retention · Multi-org management · Custom integrations · Dedicated/VPC deployment option · Dedicated support & SLA threattree.com · 30 Sept 2026

Compared on threat modeling software

Free plan: Yesthreattree.com
Attack-path analysis: Yesthreattree.com
Risk prioritization: Yesthreattree.com
Collaborative review: Yesthreattree.com
Templates and frameworks: Yesthreattree.com
Modeling methods: multiplethreattree.com
Deployment: cloudthreattree.com

Facts

Purpose: ThreatTree organizes threat models into forests containing Data Flow Diagrams and Attack Trees.threattree.com · 30 Sept 2026
Risk analysis: Likelihood-by-impact scoring automatically generates a ranked risk register across trees in a forest.threattree.com · 30 Sept 2026
Frameworks: Threats can be tagged with STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK.threattree.com · 30 Sept 2026
Controls: Mitigations can be mapped to standards including ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8, PCI DSS v4.0, NIST CSF 2.0, and SOC 2.threattree.com · 30 Sept 2026
Reports and exports: ThreatTree offers PDF reports and supports JSON and STIX 2.1 exports.threattree.com · 30 Sept 2026
Collaboration: The product supports owner, editor, and viewer roles for invited team members.threattree.com · 30 Sept 2026
Encryption: Optional per-forest AES-256-GCM encryption is available on every plan, including Free.threattree.com · 30 Sept 2026
Hosting and transport: ThreatTree says data is stored on UK servers and connections use TLS 1.2 or higher.threattree.com · 30 Sept 2026
Backups: Database backups are taken daily, retained for 30 days, encrypted, and stored separately from the primary data store.threattree.com · 30 Sept 2026
Certification: ThreatTree says it is not currently SOC 2 or ISO 27001 certified and that formal certification is on its roadmap.threattree.com · 30 Sept 2026
Integrations: The Enterprise plan lists custom Jira and ServiceNow ticketing, Terraform/OpenAPI architecture import, Splunk and Microsoft Sentinel feeds, GRC platform sync, and Confluence/Notion embeds.threattree.com · 30 Sept 2026
Support: The pricing page lists priority support with Pro and dedicated support and an SLA with Enterprise.threattree.com · 30 Sept 2026
Intended users: ThreatTree describes itself as a browser-based tool for security teams ranging from solo consultants to CISO organizations.threattree.com · 30 Sept 2026
Maker location: The maker says its team is based in the United Kingdom.threattree.com · 30 Sept 2026