CAIRIS
CAIRIS: A broad open-source choice for teams connecting threats, requirements, architecture, and risk. Ranked #1 of 24 in Threat Modeling Software by our editors (9.4/10); pricing: Free plan; best for teams needing broad, open-source threat modeling.
At a glance
- Editor score9.4 / 10
- PricingFree plan
- Best forTeams needing broad, open-source threat modeling
- Free planYes
- Paid fromFree
- Attack-path analysisYes
- Facts checked22 Sep 2026
Where it wins
- Combines data-flow, threat, requirements, and architectural modeling
- Includes risk scoring, attack trees, patterns, and reusable templates
- Supports self-hosting, APIs, imports, exports, and generated documentation
Where it doesn't
- Its broad scope may require more modeling coordination than focused tools
- Self-hosted deployment places infrastructure responsibility on the organization
- The feature set extends beyond teams seeking only basic threat diagrams
Our verdict on CAIRIS
CAIRIS is an open-source platform for designing, specifying, and validating secure and usable systems. It is intended for security designers, requirements engineers, researchers, educators, and organizations working on software or critical-infrastructure systems. The platform brings together data-flow diagrams, threat-model generation, requirements and goal modeling, usability analysis, architectural modeling, risk analysis, validation, and documentation generation. That breadth makes it suited to teams that want threat modeling connected to the wider system-design process rather than maintained as a separate activity.
Its strongest distinction is the depth of its modeling coverage. CAIRIS supports qualitative and mitigated risk scores, attack trees, attack patterns, kill-chain modeling, security and architectural patterns, reusable templates, environments, and multiple design perspectives. It can also generate specifications and GDPR DPIA documentation. This combination gives teams several ways to examine a system, prioritize risk, and connect security decisions with requirements and architecture. The tradeoff is focus: organizations wanting only quick threat diagrams may find the broader modeling scope more involved than necessary.
CAIRIS is available as open-source software under an Apache Software License, with a free plan and deployment options that include self-hosting, web access, Windows, macOS, Linux, and a live demo. An API supports integration with external tools and applications, while model import and export includes XML, Dot, and diagrams.net formats. These options fit teams that need control over deployment, interoperability, or research-oriented workflows. Choose CAIRIS when broad modeling, reusable patterns, risk prioritization, collaboration, and documentation matter together; choose a narrower tool when the requirement is limited to a simpler threat-modeling workflow.
Your product? Our editors can test CAIRIS in depth and publish a review, labelled as paid · from $149/mo →
CAIRIS pricing
CAIRIS fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Project limit | Not verified |
| Attack-path analysis | Yes |
| Risk prioritization | Yes |
| Collaborative review | Yes |
| Templates and frameworks | Yes |
| Modeling methods | Multiple |
| Deployment | Both |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Windows, macOS, Linux |
| Support | Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan |
| Website | cairis.org |
| Facts checked | 22 Sep 2026 |
Alternatives to CAIRIS
- IriusRiskA flexible threat-modeling platform with automation, integrations, and a useful free tier.9.3
- ThreatModeler NexusAI-assisted threat modeling with attack paths, risk prioritization, compliance, and CI/CD checks.9.2
- ThreatOpusA workflow-integrated threat modeling platform with a capable free plan and broad CI/CD coverage.9.1
CAIRIS vs the competition
- CAIRIS vs IriusRisk
- CAIRIS vs ThreatModeler Nexus
- CAIRIS vs ThreatOpus
- CAIRIS vs CYMETRIS
- CAIRIS vs itemis SECURE
- CAIRIS vs KAVACH
Compare CAIRIS with any tool side by side →
Used CAIRIS? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used CAIRIS for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
CAIRIS is listed in our Threat Modeling Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/cairis/"><img src="https://www.itechguides.com/best/badge/cairis.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update