Overview

Threat Dragon connects system diagrams to threat lists for diagram elements, supporting threat modeling as part of a secure development lifecycle. Users can map processes, data stores, actors, data flows and trust boundaries. This gives teams a visual basis for discussing system risks, though the project does not promise immediate investigation or response when incidents arise.

Key features

A rule engine suggests threats and mitigations, including suggestions shaped by diagram-element properties. That context can help teams focus review on the system they have modeled rather than start from a generic checklist; the suggestions still serve as a starting point for human analysis.

Threat categories include STRIDE, LINDDUN, CIA, CIA-DIE, DIE and PLOT4ai. Risk prioritization, templates and multiple modeling methods provide structure for different threat-modeling approaches. The range is useful for teams with established methods as well as beginners learning to organize a review.

The web app supports local file storage and can be configured to access GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise and GitLab. The desktop app stores models locally. Teams can therefore choose a local workflow or connect web deployment to an existing service, rather than being limited to one storage route.

The project reports signed commits, full-length SHAs for supply-chain actions, and signed and notarized desktop releases where possible. It also says automated dependency, SAST, DAST and container-security scans run on every commit. Analytics are disabled by default, require server configuration, and Plausible does not collect threat-model content or usernames. These practices may matter to security-conscious teams, but they do not remove the need to assess the deployment and its operational requirements.

Pricing

Threat Dragon is free and open source under the Apache License 2.0. Its Free plan is free and has no stated usage limits or paid plans. That makes it a straightforward fit for individuals and teams that want to adopt threat modeling without a software subscription; there is no paid tier to move to for additional capacity.

Platforms

Threat Dragon is available as a desktop application for Windows, macOS and Linux, or as a containerized, self-hosted web application. Desktop use keeps models in local storage, while the web app supports local files and configurable integrations. This flexibility suits teams choosing where to run the tool, but self-hosting means the team must operate its own web deployment.

Who it's for

Developers and defenders can use Threat Dragon to bring structured risk review into development, whether they are new to threat modeling or already use a particular framework. It is particularly suitable for teams that value open-source software, local model storage or control over web deployment. Organizations that depend on guaranteed rapid support or incident response are a weaker fit because maintenance is volunteer-led.

Pros and cons

Pros: Free, open-source use with no stated usage caps makes it accessible for teams of different sizes.
Pros: Multiple threat categories, modeling methods, templates and context-aware suggestions support structured reviews.
Pros: Desktop and self-hosted web options, plus several configurable storage integrations, give teams control over workflow and deployment.
Pros: The project describes commit, release, scanning and privacy practices that are relevant to security-focused users.
Cons: Volunteer maintenance means immediate incident investigation or response cannot always be expected.
Cons: Teams choosing the web edition must run a containerized self-hosted deployment.

Alternatives

Threat Modeling Software is a broader directory for comparing tools in this category.

Choose ThreatOpus if you want a freemium web or API option with a paid Starter plan at 129.99 GBP per month, which includes 15 users, 10 team workspaces, 50 monthly threat-modeling generations and 10 repositories.

Dethernety is another free, self-hosted web option; its Open Source plan is free and requires users to bring their own graph database.

CAIRIS is a free Apache-licensed alternative available across API, desktop, self-hosted and web platforms.

pytm is a free open-source alternative for Linux, macOS and Windows.

ThreatModeler Nexus offers a free Community Edition for practitioners, students, developers, architects and security teams to try threat modeling before scaling.

Threagile is a free toolkit under the MIT License, with API, Linux, self-hosted and web platforms.

ThreatForge is a free Apache 2.0 application with no account required, for Linux, macOS, Windows and web.

AWS Threat Composer is another free option, available across API, extension, desktop, self-hosted and web platforms.

Verdict

Threat Dragon is a strong choice for developers and defenders who want free, structured threat modeling with framework support and control over local or self-hosted deployment. Its breadth and lack of stated usage limits are compelling; teams that cannot accept volunteer-led support and uncertain response times should look elsewhere.