ThreatForge
ThreatForge: A free, visual STRIDE modeler for small teams that want version-controlled threat models. Ranked #20 of 24 in Threat Modeling Software by our editors (7.4/10); pricing: Free plan; best for small teams wanting simple free STRIDE modeling.
At a glance
- Editor score7.4 / 10
- PricingFree plan
- Best forSmall teams wanting simple free STRIDE modeling
- Free planYes
- Paid fromFree
- Facts checked22 Sep 2026
Where it wins
- Automates STRIDE analysis for each element in a visual data-flow model
- Stores models as human-readable, git-diffable YAML files
- Supports AI suggestions, Microsoft .tm7 imports, and six templates
Where it doesn't
- Does not list collaboration, verified risk prioritization, or attack-path analysis
- AI features require a bring-your-own-key setup with supported providers
- Its focus on STRIDE may not suit teams needing broader methods
Our verdict on ThreatForge
ThreatForge is a free, open-source threat-modeling application for developers and security teams. It combines a visual data-flow diagram canvas with automated STRIDE analysis for each model element. Teams can define trust boundaries, add text annotations, use keyboard shortcuts, and navigate the canvas with undo and redo. The application is available through a browser-based option and native desktop applications for macOS, Windows, and Linux, making it suitable for small teams that want a straightforward STRIDE workflow across common platforms.
Its strongest differentiator is the connection between visual modeling and version-controlled documentation. Threat models are stored as human-readable, git-diffable YAML files, which supports review and change tracking in development workflows. Six pre-built architecture templates can help teams begin with a defined structure, while imports from Microsoft Threat Modeling Tool .tm7 files support migration from that format. These capabilities make ThreatForge a practical fit for teams that want threat models to live alongside engineering work rather than as isolated diagrams.
AI-assisted threat discovery and mitigation suggestions add another layer, with support for Anthropic Claude and OpenAI through a bring-your-own-key model. That approach gives teams a way to use AI features while managing provider access themselves. The trade-off is scope: the listed capabilities do not include collaboration, verified risk prioritization, or attack-path analysis. Teams seeking a focused, free STRIDE tool with YAML-based version control should consider ThreatForge; teams needing those advanced risk and collaboration capabilities should choose a broader alternative.
Your product? Our editors can test ThreatForge in depth and publish a review, labelled as paid · from $149/mo →
ThreatForge pricing
ThreatForge fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Project limit | Not verified |
| Attack-path analysis | Not verified |
| Risk prioritization | Not verified |
| Collaborative review | Not verified |
| Templates and frameworks | Yes |
| Modeling methods | Stride |
| Deployment | Cloud |
| Deployment | Cloud, Desktop |
| Platforms | Web, Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market (editorial estimate) |
| Integrations | 2 integrations: Anthropic Claude, OpenAI |
| Pricing | Free plan |
| Website | threatforge.dev |
| Facts checked | 22 Sep 2026 |
ThreatForge integrations
ThreatForge lists 2 integrations on its own site.
- Anthropic Claude
- OpenAI
Alternatives to ThreatForge
- CAIRISA broad open-source choice for teams connecting threats, requirements, architecture, and risk.9.4
- IriusRiskA flexible threat-modeling platform with automation, integrations, and a useful free tier.9.3
- ThreatModeler NexusAI-assisted threat modeling with attack paths, risk prioritization, compliance, and CI/CD checks.9.2
See all ThreatForge alternatives →
Used ThreatForge? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used ThreatForge for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
ThreatForge is listed in our Threat Modeling Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/threatforge-threat-modeling-tool/"><img src="https://www.itechguides.com/best/badge/threatforge-threat-modeling-tool.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update