Best Threat Modeling Software in 2026
Updated
In short: CAIRIS is ranked #1 of 22 as of 4 October 2026, ahead of OWASP Threat Dragon and ThreatOpus. The best-ranked option with a free plan is OWASP Threat Dragon. The lowest first paid tier on this page is ThreatTree at $29/mo.
For teams assessing system security, threat modeling tools provide different ways to represent risks and organize review. Compare modeling methods, templates and frameworks, and risk prioritization to see how each supports your process. Attack-path analysis and collaborative review add further dimensions; deployment, project limits, free-plan availability, and paid-from pricing round out the listed criteria. AWS Threat Composer, CAIRIS, and OWASP Threat Dragon begin the ranking, followed by ThreatOpus and IriusRisk. ThreatModeler Nexus, ThreatTree, and ThreatForge are also among the first entries. Consider which modeling and review practices matter to your team, then compare the stated capabilities and limits.
22 threat modeling software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
#1 CAIRIS Top pick · 7.3 Free plan · Free
#2 OWASP Threat Dragon Runner-up · 7.2 Free plan · Free
#3 ThreatOpus Also great · 7.0 Free plan · £129.99/mo
- Free plan apiLinuxmacOSself-hostedWebWindows
- Free plan
- Yes
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - Free plan LinuxmacOSself-hostedWebWindows
- Free plan
- Yes
- Risk prioritization
- Yes
RecognisedDocumentedFree planPlatforms - Free planFree trial apiWeb
- Free plan
- Yes
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms£129.99/mofirst paid tier About ThreatOpusVisit site - Free plan apiself-hostedWeb
- Free plan
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - Free plan apiself-hostedWeb
- Free plan
- Yes
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
RecognisedDocumentedFree planPlatforms$333.33/mofirst paid tier About ThreatModeler NexusVisit site - Free plan apiWeb
- Free plan
- Yes
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms$29/mofirst paid tier About ThreatTreeVisit site - apiextensionLinuxmacOSself-hostedWebWindows
- Free plan
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - apiself-hostedWeb
- Free plan
- No
- Project limit
- 5 projects
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms€99/mofirst paid tier About CYMETRISVisit site - WebWindows
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - WebWindowsmacOSLinux
- Free plan
- Yes
RecognisedDocumentedFree planPlatforms - WindowsmacOSLinux
- Risk prioritization
- Yes
RecognisedDocumentedFree planPlatforms - Web
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - Windows
- Free plan
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - Web
- Free plan
- No
- Project limit
- 3 projects
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms -
- Free plan
- Yes
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- No
RecognisedDocumentedFree planPlatforms - Web
- Attack-path analysis
- No
- Risk prioritization
- Yes
RecognisedDocumentedFree planPlatforms -
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - Web
- Free plan
- No
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - WebRecognisedDocumentedFree planPlatforms
-
- Free plan
- No
- Attack-path analysis
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
RecognisedDocumentedFree planPlatforms - Web
- Free plan
- No
RecognisedDocumentedFree planPlatforms -
- Free plan
- Yes
RecognisedDocumentedFree planPlatforms
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which threat modeling software is ranked first on Everything Xiaomi?
CAIRIS is ranked #1 of 22 with a score of 7.3. OWASP Threat Dragon is second and ThreatOpus third.
How many of these have a free plan?
6 of the 22 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, ThreatTree has the lowest first paid tier we found: $29/mo.
How is this list ranked?
Ranked on what each maker publishes: documentation depth, a free tier and the platforms it runs on. Paid placements never change a rank.