ThreatTree
ThreatTree: A capable free threat modeling workspace for small teams that need shared analysis. Ranked #14 of 24 in Threat Modeling Software by our editors (8.0/10); pricing: Free plan; best for small teams wanting collaborative free modeling.
At a glance
- Editor score8.0 / 10
- PricingFree plan
- Best forSmall teams wanting collaborative free modeling
- Free planYes
- Attack-path analysisYes
- Facts checked22 Sep 2026
Where it wins
- Free plan includes diagrams, attack trees, frameworks, and risk registers
- Supports STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK
- Exports models as PDF, JSON, and STIX 2.1 files
Where it doesn't
- Available through the web only
- No timed Pro trial is offered
- SSO, custom integrations, and dedicated deployment require Enterprise
Our verdict on ThreatTree
ThreatTree is a browser-based threat modeling workspace for security teams, consultants, and individual builders. It brings architecture mapping, threat decomposition, and risk prioritization into one product. Data Flow Diagrams cover processes, data stores, trust boundaries, and external entities, while Attack Trees support AND/OR logic. Risk registers rank issues using likelihood and impact scores, giving teams a structured way to review threats from initial modeling through prioritization. The free plan makes the product particularly relevant to small teams and individual projects that need collaborative modeling without an upfront subscription.
Its strongest area is the combination of multiple modeling methods and security frameworks. ThreatTree supports STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK tagging, alongside standards-based control mapping. Team roles include owner, editor, and viewer, and models can be exported to PDF, JSON, or STIX 2.1. Optional client-side AES-256-GCM forest encryption adds a privacy-focused option for stored models. This breadth suits teams that need to connect architecture diagrams, attack paths, framework references, and ranked risks rather than maintain separate artifacts.
The plan structure covers a progression from individual work to enterprise governance. Free costs $0 per month and includes core diagrams, attack trees, frameworks, risk registers, and optional encryption. Pro adds full compliance standards mapping, industry modules, unlimited forests and trees, collaboration, full report generation, and audit logs; it is labeled Early adopter pricing. Enterprise adds SSO/SAML, custom roles, configurable retention policies, multi-organization management, custom integrations, a dedicated or VPC deployment option, and dedicated support with an SLA. ThreatTree is a strong fit for small teams starting with free collaborative modeling; organizations needing broader identity, deployment, or governance controls should consider Enterprise.
Your product? Our editors can test ThreatTree in depth and publish a review, labelled as paid · from $149/mo →
ThreatTree pricing
All 3 ThreatTree plans and prices →
ThreatTree fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Project limit | Not verified |
| Attack-path analysis | Yes |
| Risk prioritization | Yes |
| Collaborative review | Yes |
| Templates and frameworks | Yes |
| Modeling methods | Multiple |
| Deployment | Cloud |
| Deployment | Cloud |
| Platforms | Web |
| Compliance & security | GDPR, SSO/SAML, 2FA |
| Support | Email, Tickets, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan (source) |
| Website | threattree.com |
| Facts checked | 22 Sep 2026 |
Alternatives to ThreatTree
- CAIRISA broad open-source choice for teams connecting threats, requirements, architecture, and risk.9.4
- IriusRiskA flexible threat-modeling platform with automation, integrations, and a useful free tier.9.3
- ThreatModeler NexusAI-assisted threat modeling with attack paths, risk prioritization, compliance, and CI/CD checks.9.2
See all ThreatTree alternatives →
Used ThreatTree? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used ThreatTree for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
ThreatTree is listed in our Threat Modeling Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/threattree/"><img src="https://www.itechguides.com/best/badge/threattree.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update