OWASP Threat Dragon
OWASP Threat Dragon: A free, flexible choice for diagram-based threat modeling across web and desktop. Ranked #17 of 24 in Threat Modeling Software by our editors (7.7/10); pricing: Free plan; best for free open-source diagram-based modeling.
At a glance
- Editor score7.7 / 10
- PricingFree plan
- Best forFree open-source diagram-based modeling
- Free planYes
- Paid fromFree
- Facts checked22 Sep 2026
Where it wins
- Supports STRIDE, LINDDUN, CIA, CIA-DIE, and PLOT4ai
- Stores models through repositories, Google Drive, or local files
- Runs on web, Windows, macOS, Linux, and self-hosted deployments
Where it doesn't
- Does not provide verified attack-path analysis
- Collaborative review support is less explicit
- Threat modeling centers on diagrams and recorded mitigations
Our verdict on OWASP Threat Dragon
OWASP Threat Dragon is a free, open-source application for creating data-flow diagrams, documenting threats, and recording remediations or countermeasures. It suits security teams, developers, and architects that want a diagram-based threat modeling workflow without a paid license. Web and desktop variants support work across Windows, macOS, and Linux, while self-hosted deployment is available for teams that want to manage the web application themselves.
The Free plan includes the complete published product scope: an open-source threat modeling application with diagram editing, threat records, severity and score fields, status and mitigation fields, PDF reports, and reusable templates. Threat categorization supports STRIDE, LINDDUN, CIA, CIA-DIE, and PLOT4ai. Threat suggestions can be generated by element type and context, giving teams a structured starting point for reviewing diagrams. The product is a strong fit when the core requirement is documenting threats and prioritizing individual findings within a model.
Its ecosystem supports storage through GitHub, GitHub Enterprise, GitLab, Bitbucket, Bitbucket Enterprise, and Google Drive, alongside local files. That range fits teams already organizing engineering or security artifacts in repositories and drive-based workflows. The main boundary is its diagram-centered approach: verified attack-path analysis is not part of the documented capability set, and collaborative review is less explicit than the storage integrations. Choose OWASP Threat Dragon for free, open-source modeling with multiple methods and portable deployment options; consider another tool when attack-path analysis or clearly defined collaborative review workflows are central requirements.
Your product? Our editors can test OWASP Threat Dragon in depth and publish a review, labelled as paid · from $149/mo →
OWASP Threat Dragon pricing
All 1 OWASP Threat Dragon plans and prices →
OWASP Threat Dragon fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Project limit | Not verified |
| Attack-path analysis | Not verified |
| Risk prioritization | Yes |
| Collaborative review | Not verified |
| Templates and frameworks | Yes |
| Modeling methods | Multiple |
| Deployment | Self_hosted |
| Deployment | Self-hosted, Desktop |
| Platforms | Web, Windows, macOS, Linux |
| Support | Email, Community, Docs |
| Built for | Solo, Small business (editorial estimate) |
| Integrations | 6 integrations: GitHub, GitHub Enterprise, Google Drive, Bitbucket, Bitbucket Enterprise, GitLab |
| Pricing | Free plan (source) |
| Website | threatdragon.com |
| Facts checked | 22 Sep 2026 |
OWASP Threat Dragon integrations
OWASP Threat Dragon lists 6 integrations on its own site.
- GitHub
- GitHub Enterprise
- Google Drive
- Bitbucket
- Bitbucket Enterprise
- GitLab
Alternatives to OWASP Threat Dragon
- CAIRISA broad open-source choice for teams connecting threats, requirements, architecture, and risk.9.4
- IriusRiskA flexible threat-modeling platform with automation, integrations, and a useful free tier.9.3
- ThreatModeler NexusAI-assisted threat modeling with attack paths, risk prioritization, compliance, and CI/CD checks.9.2
See all OWASP Threat Dragon alternatives →
Used OWASP Threat Dragon? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OWASP Threat Dragon for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
OWASP Threat Dragon is listed in our Threat Modeling Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/owasp-threat-dragon/"><img src="https://www.itechguides.com/best/badge/owasp-threat-dragon.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update