What is OWASP Threat Dragon?
OWASP Threat Dragon is a modeling tool specifically designed to create diagrams that illustrate potential threats throughout a secure development lifecycle. Following the guidelines set forth in the threat modeling manifesto, Threat Dragon allows users to document possible threats and devise effective mitigation strategies, while also offering a visual overview of the various components and surfaces related to the threat model. This adaptable tool comes in both a web-based format and a desktop application, catering to different user preferences. The Open Web Application Security Project (OWASP), a nonprofit organization focused on improving software security, makes all its projects, tools, documents, forums, and chapters freely available to anyone interested in enhancing application security practices. By promoting collaboration and the exchange of knowledge, OWASP fosters a community-driven approach that aims to raise security standards in software development. Ultimately, Threat Dragon empowers developers to proactively address security concerns and integrate effective threat modeling into their workflows.
Integrations
Offers API?:
Yes, OWASP Threat Dragon provides an API
Similar Software to OWASP Threat Dragon
Criminal IP ASM
Criminal IP's Attack Surface Management (ASM) is a cutting-edge platform driven by intelligence that seeks to constantly pinpoint, catalog, and supervise all internet-connected resources associated with an organization, including often ignored and shadow assets, thereby granting teams insight into their genuine external exposure as seen by potential attackers. This innovative solution combines automated asset identification with open-source intelligence (OSINT) techniques, enhancements via artificial intelligence, and advanced threat intelligence to uncover exposed hosts, domains, cloud services, IoT devices, and various other entry points on the internet, while also gathering evidence like screenshots and metadata, linking discoveries to known vulnerabilities and tactics used by attackers. By assessing exposures in terms of business significance and risk, ASM highlights vulnerable components and misconfigurations, delivering real-time alerts and interactive dashboards that streamline investigation and remediation processes. Moreover, this all-encompassing tool not only aids organizations in managing their security stance but also equips them to stay ahead of emerging threats by fostering a proactive security culture within their teams. Ultimately, the proactive management of attack surfaces can significantly enhance an organization's resilience against cyber risks.
Learn more
ThreatLocker
ThreatLocker is a Zero Trust platform designed to prevent cyber threats by ensuring only trusted applications and processes are allowed to operate. It eliminates persistent admin privileges, applies least privilege controls, and gives organizations granular control over how software runs. Through application allowlisting, ringfencing, and storage controls, it blocks ransomware, zero day attacks, and unauthorized behavior before anything can execute.
Built for today’s IT and security teams, ThreatLocker delivers centralized control and real time visibility across endpoints, users, and applications. It reduces attack surface, limits lateral movement, and supports compliance with detailed logging and audit trails. With rapid deployment, a continuously maintained application library, and efficient approval processes, organizations can enhance security while lowering operational complexity and maintaining uptime.
Learn more
Fork
Fork is an innovative SaaS solution tailored for threat modeling, empowering both security and product teams to carry out continuous, risk-focused evaluations of applications by leveraging the proven PASTA (Process for Attack Simulation and Threat Analysis) methodology. This functionality enables teams to quickly pinpoint the most likely and critical risks within a two-hour timeframe, ensuring that security protocols are effectively aligned with organizational goals. By integrating specialized threat libraries alongside up-to-date vulnerability data and threat intelligence, Fork provides precise measurements of residual risks and supports thorough business impact assessments. The platform incorporates stringent quality controls throughout the threat modeling process to boost overall efficacy. Moreover, Fork offers a unified security insights dashboard that connects threats directly to the application's attack surface, while also incorporating well-established frameworks and taxonomies such as MITRE, OWASP, CWE, CVE (with EPSS), CAPEC, ATT&CK, D3FEND, and ASVS, facilitating targeted mitigation strategies and actionable results. This holistic strategy not only strengthens the security posture of organizations but also promotes synergy between technical experts and business stakeholders, leading to enhanced decision-making and risk management. In doing so, Fork transforms threat modeling into a collaborative effort that drives both security and business success.
Learn more
Devici
Devici helps security and engineering teams build threat models that are consistent, reviewable, and easy to maintain as systems evolve. It focuses on capturing the architecture first, using a visual canvas where teams lay out processes, data stores, external entities, and trust boundaries. As components are described and attributes are applied, Devici identifies relevant threats and suggested mitigations from its built-in library, reducing the manual effort normally required to reason through diagrams or ad-hoc checklists.
The tool is designed so that AppSec specialists, developers, and security champions can work together without specialized training. Real-time editing, in-model comments, and version history support collaborative reviews and allow teams to trace how decisions and risks change over time. Reusable templates and patterns make it simple to model common services or shared architecture pieces, helping larger organizations avoid duplicated work across teams.
Devici also supports pushing mitigation tasks into existing development workflows through optional integrations, ensuring threat modeling outputs don’t remain isolated from day-to-day engineering. Its structure helps organizations move away from one-off diagrams and inconsistent documentation toward a predictable, repeatable approach that fits into modern development practices. Overall, Devici offers a practical way to raise the quality and clarity of threat modeling efforts without requiring complex onboarding or heavyweight tooling.
Learn more
Screenshots and Video
Company Facts
Company Name:
OWASP
Date Founded:
2001
Company Location:
United States
Company Website:
owasp.org/www-project-threat-dragon/
Product Details
Deployment
SaaS
Training Options
Video Library
Support
Web-Based Support
Product Details
Target Company Sizes
Individual
1-10
11-50
51-200
201-500
501-1000
1001-5000
5001-10000
10001+
Target Organization Types
Mid Size Business
Small Business
Enterprise
Freelance
Nonprofit
Government
Startup
Supported Languages
English