OWASP Threat Dragon
6.4#5 in threat modeling softwareFree planFree planWebLinuxmacOSSelf-hosted
VisitOWASP Threat Dragon vs ThreatTree
ThreatTree
6.6#4 in threat modeling softwareFrom $29 a monthFree planWebAPI
VisitWhat both publish
| Fact | OWASP Threat Dragon | ThreatTree |
|---|---|---|
| Intended users | OWASP describes Threat Dragon as intended for developers and defenders, and says both experienced threat modelers and beginners can use it. | ThreatTree describes itself as a browser-based tool for security teams ranging from solo consultants to CISO organizations. |
| Purpose | Threat Dragon creates threat model diagrams and lists threats for diagram elements as part of a secure development lifecycle. | ThreatTree organizes threat models into forests containing Data Flow Diagrams and Attack Trees. |
| Support | The project directs users to its mailing list, OWASP Slack channel, GitHub issues and public discussions for questions, bugs and feature requests. | The pricing page lists priority support with Pro and dedicated support and an SLA with Enterprise. |
OWASP Threat Dragon plans
- FreeFree
ThreatTree plans
- FreeFree
- Pro$29 a month
- EnterprisePriced on request
Pick OWASP Threat Dragon if…
Threat Dragon is intended for developers and defenders, including both experienced threat modelers and beginners. It suits teams that want to create threat diagrams and use supported threat categories and suggestions.
Pick ThreatTree if…
ThreatTree is intended for security teams ranging from solo consultants to CISO organizations. It may suit teams that need structured threat models, risk prioritization, and collaborative review.