ThreatTree review
A capable free threat modeling workspace for small teams that need shared analysis.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
ThreatTree is a browser-based threat modeling workspace for security teams, consultants, and individual builders. It brings architecture mapping, threat decomposition, and risk prioritization into one product. Data Flow Diagrams cover processes, data stores, trust boundaries, and external entities, while Attack Trees support AND/OR logic. Risk registers rank issues using likelihood and impact scores, giving teams a structured way to review threats from initial modeling through prioritization. The free plan makes the product particularly relevant to small teams and individual projects that need collaborative modeling without an upfront subscription.
Its strongest area is the combination of multiple modeling methods and security frameworks. ThreatTree supports STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK tagging, alongside standards-based control mapping. Team roles include owner, editor, and viewer, and models can be exported to PDF, JSON, or STIX 2.1. Optional client-side AES-256-GCM forest encryption adds a privacy-focused option for stored models. This breadth suits teams that need to connect architecture diagrams, attack paths, framework references, and ranked risks rather than maintain separate artifacts.
The plan structure covers a progression from individual work to enterprise governance. Free costs $0 per month and includes core diagrams, attack trees, frameworks, risk registers, and optional encryption. Pro adds full compliance standards mapping, industry modules, unlimited forests and trees, collaboration, full report generation, and audit logs; it is labeled Early adopter pricing. Enterprise adds SSO/SAML, custom roles, configurable retention policies, multi-organization management, custom integrations, a dedicated or VPC deployment option, and dedicated support with an SLA. ThreatTree is a strong fit for small teams starting with free collaborative modeling; organizations needing broader identity, deployment, or governance controls should consider Enterprise.
ThreatTree pros and cons
- Where it wins
- Free plan includes diagrams, attack trees, frameworks, and risk registers
- Supports STRIDE, LINDDUN, OWASP Top 10, CAPEC, and MITRE ATT&CK
- Exports models as PDF, JSON, and STIX 2.1 files
- Where it doesn't
- Available through the web only
- No timed Pro trial is offered
- SSO, custom integrations, and dedicated deployment require Enterprise
ThreatTree fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update