Threat Modeling & Security Architecture Review
Finds design-level threats and countermeasures before code is written, and keeps the review on record.
Overview
Threat modeling tools capture a system's design (architecture diagrams, data flows, trust boundaries, cloud accounts or infrastructure-as-code), identify threats against it with a method such as STRIDE, LINDDUN, PASTA or attack trees, and turn the result into countermeasures and security requirements kept as a reviewed, versioned record. Security architecture review is the same discipline applied as a gate: a new system, cloud design or major change is reviewed and the outcome recorded. It is the secure-by-design step before code exists: SAST/DAST/IAST test code once it is written, software composition analysis covers dependencies, DevSecOps tooling secures pipelines and secrets, and CSPM checks deployed cloud configuration. Commercial platforms are quote-only enterprise subscriptions, and the market consolidated in 2025: Security Compass bought Devici (June 2025) and ThreatModeler and IriusRisk merged (completed December 2025). Open source is genuinely usable, covering diagram-first modeling (OWASP Threat Dragon), threat-modeling-as-code (OWASP pytm) and structured threat statements (AWS Threat Composer), but none offers the compliance-mapped countermeasure libraries, portfolio governance and issue-tracker workflow of the commercial platforms.
The design is the cheapest place to fix a flaw; tooling earns its keep once new systems arrive faster than one architect can review them.
Advantages
- Catches design flaws when they are cheapest to fix, before code, infrastructure or vendor choices are locked in
- Leaves a reviewable record of threats, decisions and accepted risks that can be shown to auditors and customers
- Countermeasures flow into the engineering backlog as tracked tickets (Jira, Azure DevOps, ServiceNow) instead of a document nobody reads
- IaC and live-cloud import (Terraform, CloudFormation, ARM; AWS, Azure, GCP) keeps models closer to what is actually deployed
- Credible free options exist for every style: diagram-first, as-code, threat-statement and LLM-assisted
Trade-offs
- Output quality still depends on skilled reviewers; tools speed modeling up but do not replace security-architecture judgement
- Models go stale unless they are re-run on design changes; a point-in-time model drifts from the real system
- Commercial platforms are quote-only, and two of the four commercial products listed here changed owners in 2025, so roadmaps are in flux
- AI-drafted threat models are non-deterministic and need human validation; vendor time-saving figures are self-published
- Free tools lack compliance-mapped countermeasure libraries, multi-user governance and portfolio reporting
Open-source option
OWASP Threat Dragon (Apache-2.0), OWASP pytm (MIT) and AWS Threat Composer (Apache-2.0) are actively maintained, self-hostable and listed here, and STRIDE GPT (MIT) adds LLM-assisted drafting. They cover modeling and threat identification well; what they lack is compliance-mapped countermeasure libraries, multi-user governance and issue-tracker workflow. Threagile (MIT) also qualifies on licence, but its last tagged release was July 2024.
Vendors & tools in this area
Automated threat modeling from diagrams and IaC with compliance libraries; part of ThreatModeler since Dec 2025, free Community tier.
Visit site →Agentic enterprise threat modeling platform with live-cloud and IaC modeling; merged with rival IriusRisk in Dec 2025.
Visit site →Survey-driven security requirements and threat modeling backed by a large compliance-mapped content library.
Visit site →Attribute-driven visual threat modeling canvas; acquired by Security Compass in June 2025 and feeds SD Elements.
Visit site →Free Windows desktop tool from Microsoft's SDL: draw a data-flow diagram, get STRIDE-per-element threats.
Visit site →OWASP open-source diagramming tool with a rule engine for STRIDE, LINDDUN, CIA, DIE and PLOT4ai threats.
Visit site →OWASP threat-modeling-as-code: describe the system in Python, generate data-flow and sequence diagrams and threats.
Visit site →AWS Labs' open-source threat-statement tool: browser-only web app, VS Code extension and an experimental AI CLI.
Visit site →