Overview

CAIRIS brings assets, countermeasures, factoids, personas, requirements, and architectural components into a shared design model. That is useful when a team needs to consider user needs and security together, rather than treating threat modeling as a separate end-stage exercise. It is a more substantial choice than a tool focused only on drawing threat diagrams.

As a design develops, CAIRIS can produce 12 views across people, risks, requirements, architecture, and physical location, and generate threat models such as Data Flow Diagrams. These connected outputs can help teams track how analysis relates to the evolving system, but their usefulness depends on keeping the model accurate and current.

Key features

Security analysis and documentation

Multiple modeling methods, attack-path analysis, and risk prioritization support a broad security review. Attack and architectural patterns help assess attack surface and check designs for known security problems and potential GDPR compliance issues. CAIRIS can also generate Volere-compliant requirement specifications and GDPR DPIA documents, giving teams a way to carry design analysis into formal documentation. These checks support the work; they do not replace a team's judgment about its system or compliance obligations.

Integration and deployment

The API can support custom design applications or connect CAIRIS to an existing toolchain. Installation options include Docker, Vagrant, or building from source on platforms supported by its open-source dependencies; Ubuntu is the most tested platform. That flexibility will suit technical teams able to manage their own deployment, while it is less attractive for users seeking a ready-made, managed service. The web application supports modern browsers, including Edge, but not Internet Explorer. A Chrome extension can turn highlighted webpage text into document references linked to a CAIRIS server.

Demo caution

The live demo is rebuilt nightly, and its guidance warns that every database is visible to everyone. Export models to avoid losing work during rebuilds; accounts other than the recreated test account are deleted on Sunday mornings. It is useful for a short look at the application, not for sensitive data or dependable ongoing work.

Pricing

Free — free. CAIRIS is freely available under the Apache Software License, making the full platform a viable option for individuals and teams prepared to deploy and maintain it themselves. No seat or usage caps are stated for this plan. The trade-off is operational: Docker, Vagrant, or source installation puts deployment responsibility on the user rather than bundling a managed service. For problems or feature requests, the maker directs users to raise a GitHub issue or get in touch.

Platforms

CAIRIS supports API, Linux, macOS, self-hosted, web, and Windows. The browser application excludes Internet Explorer, and Ubuntu is the most tested installation platform. The API and self-hosting options make it adaptable to technical environments, but teams should account for deployment and maintenance rather than assume a turnkey hosted setup.

Who it's for

CAIRIS is a strong fit for architects, security practitioners, and requirements teams that need threat analysis, user perspectives, and formal specifications to evolve together. Teams that want a quick, standalone diagramming workflow or do not want to manage deployment may prefer a more focused or managed product.

Pros and cons

Pro: A shared model covers security, usability, requirements, and architecture, helping teams reason across disciplines.
Pro: Generated views, threat models, and formal documents can keep design analysis connected to evolving requirements.
Pro: Free Apache-licensed availability, API access, and multiple deployment routes give technical teams room to adapt the platform.
Con: Self-hosting or installation from source requires technical ownership; it is not a frictionless managed-service choice.
Con: The public demo exposes databases to everyone and is rebuilt nightly, so it cannot serve as a confidential or durable workspace.

Alternatives

Browse the Threat Modeling Software directory if you want to compare a wider set of tools.

ThreatOpus is worth considering if you want a freemium web/API option with a free trial or a paid Starter plan that specifies user, workspace, generation, and repository allowances.
OWASP Threat Dragon is another free, open-source option across web, desktop, and self-hosted platforms if you want threat modeling without CAIRIS's wider requirements and usability model.
ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects, and security teams to try threat modeling before scaling; consider it if that entry point better matches your needs.
ThreatForge is a free, open-source choice with no account required and an application available to everyone, which may suit users seeking a simple way to start without an account.
AWS Threat Composer is another free option to compare.
IriusRisk may fit teams who want a free Community Edition capped at three active threat models and one user with limited collaboration, alongside templates, libraries, and XML diagram export.
ThreatTree has a free plan capped at three forests, three DFDs per forest, and five Attack Trees per DFD; its Pro tier is 29.00 USD per month per user for readers who need more room.
ThreatZ is another option to compare.

Verdict

Choose CAIRIS if your team needs one design environment to connect requirements, user perspectives, architecture, and security analysis, and can take responsibility for deployment. Its free Apache-licensed availability and generated analysis make it compelling for structured design work. Look elsewhere if you need managed convenience, or if you need a public demo to protect or retain your working data.

	CAIRIS	EnCo SOX ATA
Free plan	Yes
Paid from	Free
Platforms	api, Linux, macOS, self-hosted, Web, Windows	Web, Windows
Free plan	Yes
Attack-path analysis	Yes	Yes
Risk prioritization	Yes	Yes
Collaborative review	Yes	Yes
Templates and frameworks	Yes
Modeling methods	multiple
Deployment	both

CAIRIS vs EnCo SOX ATA

CAIRIS

EnCo SOX ATA