AWS Threat Composer helps people identify security issues and plan responses through iterative threat modeling. It uses structured threat grammar and adaptive suggestions to help compose threat statements. A model can include architecture and data-flow diagrams, tracked assumptions, links between threats and mitigations, and an insights dashboard with quality metrics and improvement suggestions. Users can manage multiple models and export them as JSON, Markdown, DOCX, or PDF. The web app offers browser-based storage, import and export, and can be used as a hosted demo or deployed as a customizable static site in an AWS account. The VS Code extension included in AWS Toolkit edits .tc.json files, works offline, and stores data locally, so threat models can sit alongside code in version control. A browser extension displays files from GitHub, GitLab, Bitbucket, and Amazon CodeCatalyst, but is read-only and needs internet access for web-hosted files. Experimental AI CLI and MCP tools can analyze code for starter models; AWS Bedrock inference costs apply.
Who it is for
It suits people who need to model system threats, especially teams that want to maintain models alongside code in version control. The AI tools are aimed at users who want code analysis to produce starter models, but are marked experimental.
What is good
- Includes diagrams, assumption tracking, and threat-mitigation links
- Exports models in four formats
- VS Code extension works offline and stores data locally
- Free plan and self-hosting option
What to know first
- Browser extension is read-only
- Browser extension needs internet access for web files
- AI CLI and MCP tools are experimental and incur Bedrock costs
- Browser extension publication is not yet available in Chrome or Firefox stores
Verdict
Threat Composer combines structured threat writing with diagrams, model tracking, and several export options. Its offline VS Code workflow and free plan are useful, while the browser add-on and experimental AI tools have specific limits.
Compared on threat modeling software
- Free plan
- Yes
- Risk prioritization
- Yes
- Collaborative review
- Yes
- Templates and frameworks
- Yes
- Deployment
- both
