Best Threat Modeling Software in 2026
Updated
In short: AWS Threat Composer is ranked #1 of 22 as of 4 October 2026, ahead of ThreatModeler Nexus and ThreatOpus. The best-ranked option with a free plan is ThreatModeler Nexus. The lowest first paid tier on this page is ThreatTree at $29/mo.
Threat modeling software supports structured review of possible risks and the systems they affect. Compare modeling methods, templates and frameworks, and risk prioritization, then consider attack-path analysis and collaborative review. Deployment, project limit, free-plan availability, and paid-from pricing add practical dimensions for teams assessing fit. AWS Threat Composer and ThreatModeler Nexus open the ranking, with ThreatOpus and ThreatTree also among the first entries, followed by CAIRIS. Use the listed methods and workflow features to compare options against how your team plans and reviews security work.
22 threat modeling software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
| # | Platform | Score | Why | From | Free plan | Paid from | Project limit | |
|---|---|---|---|---|---|---|---|---|
| 1 | AWS Threat Composer | 7.4 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 2 | ThreatModeler Nexus | 7.4 | RecognisedAPIDocumented | $333.33/mo | Yes | — | — | View |
| 3 | ThreatOpus | 7.4 | RecognisedAPIDocumented | £129.99/mo | Yes | — | — | View |
| 4 |  ThreatTree | 7.4 | RecognisedAPIDocumented | $29/mo | Yes | — | — | View |
| 5 |  CAIRIS | 7.3 | RecognisedAPIDocumented | Free | Yes | — | — | View |
| 6 | IriusRisk | 7.3 | RecognisedAPIDocumented | Free | Yes | — | — | View |
| 7 | CYMETRIS | 6.8 | RecognisedAPIDocumented | €99/mo | No | — | 5 projects | View |
| 8 |  OWASP Threat Dragon | 5.9 | RecognisedAPIDocumented | Free | Yes | — | — | View |
| 9 |  ADTool | 5.6 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 10 | Microsoft Threat Modeling Tool | 5.5 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 11 |  ThreatForge | 5.5 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 12 |  itemis SECURE | 5.2 | RecognisedAPIDocumented | — | — | — | — | View |
| 13 |  TSpec | 5.2 | RecognisedAPIDocumented | — | Yes | — | — | View |
| 14 | AutoSec TARA Suite | 5.1 | RecognisedAPIDocumented | — | — | — | — | View |
| 15 | Dethernety | 5.1 | RecognisedAPIDocumented | — | — | — | — | View |
| 16 | EnCo SOX ATA | 5.1 | RecognisedAPIDocumented | — | — | — | — | View |
| 17 |  KAVACH | 5.1 | RecognisedAPIDocumented | — | No | — | — | View |
| 18 |  pytm | 5.1 | RecognisedAPIDocumented | — | — | — | — | View |
| 19 |  SD Elements | 5.1 | RecognisedAPIDocumented | — | No | — | — | View |
| 20 |  Threagile | 5.1 | RecognisedAPIDocumented | — | — | — | — | View |
| 21 |  ThreatZ | 5.1 | RecognisedAPIDocumented | — | No | — | 3 projects | View |
| 22 | DevArmor | 4.8 | RecognisedAPIDocumented | — | No | — | — | View |
Is your platform on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which threat modeling software is ranked first on Inferse?
AWS Threat Composer is ranked #1 of 22 with a score of 7.4. ThreatModeler Nexus is second and ThreatOpus third.
How many of these have a free plan?
5 of the 22 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, ThreatTree has the lowest first paid tier we found: $29/mo.
How is this list ranked?
Ranked on what each maker publishes, open and connectable first: a public API, open-source code, the depth of its documentation and a free tier to try it on. Model lists are sorted by the figure in their title, exactly as each provider publishes it. Paid placements never change a rank.