A free, open-source, cross-platform desktop application for threat modeling with system diagramming and automated threat generation.
OWASP Threat Dragon Desktop is a free, open-source desktop application for threat modeling. It enables users to create system diagrams and automatically generates security threats and mitigations based on those diagrams. The tool helps integrate threat modeling into the development lifecycle by providing an accessible, offline-capable environment.
Security professionals, developers, and DevOps teams who need to perform threat modeling as part of their secure development practices, especially those preferring a desktop application over web-based tools.
It offers a user-friendly, cross-platform desktop experience with local file storage, automated threat generation, and strong integration capabilities, all while being completely free and open-source under the OWASP project umbrella.
An installable desktop variant of OWASP Threat Dragon
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The rule engine automatically generates and ranks threats based on system diagrams, reducing manual analysis time and ensuring consistent threat identification, as highlighted in the key features.
Models are stored locally on the filesystem, providing full offline access and enhanced privacy without reliance on internet connectivity, ideal for air-gapped or secure environments.
Available via installers for Windows, macOS, and packages for Debian and Fedora Linux, ensuring wide compatibility across different development and operating systems.
As an OWASP Incubator Project, it's completely free and open-source, with active community contributions, vulnerability disclosure processes, and no vendor lock-in.
The desktop variant only supports local file storage, lacking built-in cloud sync, version control integration, or alternative backends, which hampers team collaboration and backup workflows.
Built on Electron, the application may have higher memory and disk usage compared to native desktop apps, potentially impacting performance on lower-spec machines.
As an OWASP Incubator Project, it might have slower feature development, fewer third-party integrations, and less comprehensive documentation compared to mature commercial tools.