Secure Design & Threat Modeling

Now pick what to compare Threagile against.

Threagile clear

Open a name for its full profile

IriusRisk
Capabilities only
IriusRisk · Freemium · 5 capabilities in this domain
Compare →
Threagile
Capabilities only
Threagile Project · Open Source · 3 capabilities in this domain
selected
ThreatModeler
Capabilities only
ThreatModeler Software · Commercial · 3 capabilities in this domain
Compare →
Microsoft Threat Modeling Tool
Capabilities only
Microsoft Security Engineering · Free · 2 capabilities in this domain
Compare →
OWASP Threat Dragon
Capabilities only
OWASP Foundation · Open Source · 2 capabilities in this domain
Compare →
OWASP pytm
Capabilities only
OWASP Foundation · Open Source · 2 capabilities in this domain
Compare →
SD Elements
Capabilities only
Security Compass · Commercial · 2 capabilities in this domain
Compare →
Censys Attack Surface Management
Capabilities only
Censys · Commercial · 1 capabilities in this domain
Compare →
Cortex Xpanse
Capabilities only
Palo Alto Networks · Commercial · 1 capabilities in this domain
Compare →
Microsoft Defender External Attack Surface Management
Capabilities only
Microsoft · Commercial · 1 capabilities in this domain
Compare →

In Secure Design & Threat Modeling

IriusRisk

IriusRisk · Secure Design & Threat Modeling

Close ×

FreemiumCompany

IriusRisk applies rules and libraries (including AI/ML and cloud components) to diagrams to produce threats, security requirements and test cases, synchronized to issue trackers.

What it does5 capabilities · 3 at full coverage

3 of 5 at full coverage.

Architecture Risk AnalysisPartialDESIGN · level 3 · 2 providers
Data Flow & Trust Boundary MappingFullDESIGN · level 2 · 6 providers
Security Requirements GenerationFullDESIGN · level 2 · 4 providers
Threat ModelingFullDESIGN · level 2 · 6 providers
Threat Modeling as CodePartialDESIGN · level 3 · 3 providers

What it proves28 controls across 9 frameworks

Satisfied through its capabilities, not claimed by the vendor.

SAMM 2.011 / 90D-SA-1-A D-SA-2-A D-SR-1-A D-SR-2-A D-TA-1-B D-TA-2-B D-TA-3-B V-AA-1-A V-AA-1-B V-AA-2-A V-RT-1-A
CSF 2.04 / 106GV.SC-05 ID.AM-03 ID.RA-03 ID.RA-04
SSDF 1.14 / 42PO.1.2 PW.1.1 PW.1.2 PW.2.1
CRA3 / 41Annex I Part I (1) Annex I Part I (2)(j) Annex I Part I (2)(k)
AI RMF2 / 19MAP 1 MAP 2
ASVS 5.01 / 17V15
CIS Controls1 / 18CIS 16
DSOMM1 / 19CO-Design
OWASP Top 101 / 10A06:2025

What it stops2 techniques · 1 risk

2 techniques countered, 0 of them common

SLSA threat D: Build from modified source or parametersSLSA-D
SLSA threat E: Compromised build processSLSA-E

1 risks reduced

Design-level security flaw shipped to productionHigh

Where it runs2 phases · 2 ways to deploy

Capabilities per lifecycle phase

Plan5
Code1

How it is delivered

SaaSSelf-hosted

What it unlocks5 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Capture security requirements for new featuresLow effort

Level 2

Threat model critical applications and their pipelinesMedium effort

Level 3

Maintain threat models as code in CIMedium effort

Level 4

Validate the real attack surface against the designMedium effort

Level 5

Reference architectures eliminate design flaw classesHigh effort

How it holds up2 strengths · 1 limitation

Strengths

Large threat and countermeasure libraries
Jira and ALM integration

Limitations

Requires library curation for accuracy

What it costsPlatform enterprise agreement · free tier

LicensingPlatform enterprise agreement

Priced perannual contract

BillingSubscription

Scales withNegotiated scope (developers, assets, modules)

Total cost

Opaque list pricing; benchmark with peers and require clear overage terms.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13