ThreatOpus

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

ThreatOpus is ranked #3 of 22 in threat modeling software on Inferse. It runs on API, Web. A free trial is offered. Paid plans start at £129.99/mo.

Compared on threat modeling software

Free plan: Yesthreatopus.com
Attack-path analysis: Yesthreatopus.com
Risk prioritization: Yesthreatopus.com
Collaborative review: Yesthreatopus.com
Templates and frameworks: Yesthreatopus.com
Modeling methods: multiplethreatopus.com
Deployment: boththreatopus.com

Facts

Product: ThreatOpus combines threat modelling with pull request security checks that return PASS, WARN, or FAIL outcomes in a CI pipeline.threatopus.com · 30 Sept 2026
Threat modelling: Teams can describe a system, import from OpenAPI or Terraform, or link a GitHub repository to generate STRIDE threats and track mitigations.threatopus.com · 30 Sept 2026
Methodologies: STRIDE is available on every plan, while Pro adds nine additional threat modelling frameworks.threatopus.com · 30 Sept 2026
PR security: Merge Guard evaluates pull requests against policy bundles and returns decisions with reasons posted to CI checks.threatopus.com · 30 Sept 2026
Integrations: Listed source control and CI integrations include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure DevOps, TeamCity, AWS CodeBuild, and Travis CI.threatopus.com · 30 Sept 2026
Notifications: ThreatOpus can send check outcome notifications to Slack and Microsoft Teams.threatopus.com · 30 Sept 2026
API keys: PR Security supports scoped API keys for custom pipeline steps or internal orchestration.threatopus.com · 30 Sept 2026
Retention controls: Project settings let users choose whether raw architecture input is stored, set its retention period, and decide whether structured threat output remains after raw input expires.threatopus.com · 30 Sept 2026
Data export and deletion: Signed-in users can export their data as JSON and delete content they created through Data controls.threatopus.com · 30 Sept 2026
Authentication: Accounts use email verification and password policies, sessions use httpOnly cookies, and optional two-factor authentication is available in user settings.threatopus.com · 30 Sept 2026
Subprocessors: ThreatOpus says it does not sell personal data and that customers can request a subprocessor list for security review.threatopus.com · 30 Sept 2026
Support: The pricing page lists email support on Starter and Pro, and priority support on Pro and Enterprise.threatopus.com · 30 Sept 2026
Intended users: ThreatOpus describes its intended users as security teams, security champions, and platform engineers seeking governed threat models and clear merge decisions.threatopus.com · 30 Sept 2026
Assessment limitation: ThreatOpus says generated threats and mitigations support security work but do not replace professional assessment, penetration testing, or formal risk acceptance.threatopus.com · 30 Sept 2026