Audience
Threat Modeling solution for organizations
About OWASP Threat Dragon
OWASP Threat Dragon is a modeling tool used to create threat model diagrams as part of a secure development lifecycle. Threat Dragon follows the values and principles of the threat modeling manifesto. It can be used to record possible threats and decide on their mitigations, as well as giving a visual indication of the threat model components and threat surfaces. Threat Dragon runs either as a web application or a desktop application. The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. All of our projects, tools, documents, forums, and chapters are free and open to anyone interested in improving application security.
Other Popular Alternatives & Related Software
Devici
Devici is a diagram-focused threat modeling tool that helps AppSec teams and DevSecOps engineers create clear, repeatable models without relying on scattered diagrams or manual documents. Teams map system components, describe their behavior through attributes, and Devici identifies relevant threats and possible mitigations from its maintained library. The platform supports real-time collaboration, reusable patterns, templates, and version history, which helps groups standardize how they document risks across applications. Developers can contribute without needing deep threat modeling knowledge, while security teams can guide reviews and maintain consistency. Devici offers a practical way to keep threat models current as designs change and reduces the effort required to move from architecture diagrams to actionable security decisions.
Learn more
IriusRisk
Build-Safer-Faster with the AI Threat Modeling Tool. IriusRisk empowers the world's leading organizations to be Secure by Design.
For enterprise software teams in highly regulated industries (Financial Services, Healthcare, Critical Infrastructure, Government), IriusRisk is the only threat modeling platform that combines AI and industry-specific security frameworks, with comprehensive training and onboarding to deliver proactive risk management at the speed of modern development.
IriusRisk enables teams to ship features against Secure by Design initiatives, while meeting the most stringent compliance requirements.
Learn more
Resurface
Resurface is a runtime API security solution. Detect and respond to API threats and risk in real-time with Resurface continuous API scanning. Purpose-built for API data, Resurface captures complete request and response payloads (including GraphQL) to instantly see threats and failures. Get alerts on data breaches for zero-day detection and response.
Mapped to OWASP Top10, Resurface alerts on threats with complete data security patterns and behaviors. Resurface is self-hosted, all data is first-party, installed with a single Helm command.
Resurface is the only API security solution engineered for deep inspection at scale. Handling millions of API calls, Resurface detects and alerts on active attacks. Machine learning models indicate anomalies and identify low-and-slow attack patterns.
Learn more
Microsoft Threat Modeling Tool
Threat modeling is a core element of the Microsoft Security Development Lifecycle (SDL). It’s an engineering technique you can use to help you identify threats, attacks, vulnerabilities, and countermeasures that could affect your application. You can use threat modeling to shape your application's design, meet your company's security objectives, and reduce risk. The Microsoft Threat Modeling Tool makes threat modeling easier for all developers through a standard notation for visualizing system components, data flows, and security boundaries. It also helps threat modelers identify classes of threats they should consider based on the structure of their software design. We designed the tool with non-security experts in mind, making threat modeling easier for all developers by providing clear guidance on creating and analyzing threat models.
Learn more
Company Information
OWASP
Founded: 2001
United States
owasp.org/www-project-threat-dragon/
Videos and Screen Captures
Other Useful Business Software
Find Hidden Risks in Windows Task Scheduler
Windows Task Scheduler might be hiding critical failures. Download the free JAMS diagnostic tool to uncover problems before they impact production—get a color-coded risk report with clear remediation steps in minutes.
Product Details
Platforms Supported
Cloud
Training
Videos
Support
Online
