Help Center

Getting Started

ThreatTree organizes your work into Forests. A forest is a container for one system, product, or engagement — inside it you build Data Flow Diagrams (DFDs) to map architecture, and Attack Trees to decompose specific threats against that architecture. Findings roll up automatically into a Risk Register, which you can export as a PDF report.

1. Create your first forest

1. From your Dashboard, click New Forest (top right).
2. Give it a Name — e.g. "Acme Corp Threat Model" — and an optional Description (scope, system under analysis).
3. Click Create Forest. You're dropped into the empty forest, ready to add your first diagram.

2. Add a diagram

Inside a forest, click New DFD or New Attack Tree (or use the generic Add Tree flow, which opens a modal where you name the tree and pick its type: Data Flow Diagram — "Map system components and trust boundaries" — or Attack Tree — "Decompose a threat with AND/OR logic"). If you choose Attack Tree, you can optionally link it to an existing DFD right there, or do it later — see Linking DFDs & Attack Trees.

3. Which one do I build first?

Most engagements start with a DFD to establish what the system actually looks like — its processes, data stores, trust boundaries, and external actors — and then build one or more Attack Trees against specific goals an attacker might pursue within that architecture (e.g. "Exfiltrate customer PII", "Achieve unauthorized admin access"). You don't have to link them, but doing so keeps your threat model traceable back to the architecture it's describing.

Plan limits

The Free plan is fully-featured but capped in size; Pro adds unlimited forests, collaboration, backup & restore, full compliance standards mapping, audit logs, STIX 2.1 export, and Industry Modules, and Enterprise adds SSO/SAML, IP allowlisting, and custom integrations on top of that. Core threat-elicitation frameworks (STRIDE, LINDDUN, OWASP Top 10, CAPEC), encryption, and the Risk Register PDF export are available on every plan.

Feature comparison

See the full breakdown and current pricing on the Membership & Pricing page.

Data Flow Diagrams

A DFD maps what your system is made of and how data moves through it: processes, data stores, external actors, and the trust boundaries between them. It's the architecture layer your Attack Trees get built against.

The palette

The left-hand palette holds every element you can drag onto the canvas, split into two groups. Every item also works from the keyboard: Tab to it and press Enter or Space to place it at the canvas centre, no mouse required. Use the search box at the top of the palette to filter by name if you're hunting for one specific element.

Standard notation ("Elements" group)

Non-Standard group — infrastructure elements

These aren't part of classic DFD notation, but they let you be specific about the infrastructure sitting behind a Process without inventing a workaround. Each renders as a colored box with a two/three-letter badge.

Trust boundaries in detail

A Trust Boundary has a Kind: Logical (default — a conceptual boundary with no further classification) or Physical. Physical boundaries unlock a Sub-type dropdown:

• Trusted Network, Untrusted Network, Internet, On-Premise — each renders with a distinct fill/stroke color so boundary types are visually distinguishable at a glance.
• Cloud Provider — unlocks a further Cloud Provider dropdown with 16 options (AWS, Azure, GCP, OCI, Alibaba Cloud, IBM Cloud, DigitalOcean, Linode/Akamai, Hetzner, Vultr, Scaleway, OVHcloud, Huawei Cloud, Tencent Cloud, Cloudflare Workers, Other). AWS, Azure, GCP, and OCI get their real brand colors on the boundary; the rest use a generic cloud style.

Drawing data flows (connections)

Select a node, then click Draw connection in the right-hand properties panel (it toggles to Cancel connection while active) — then click the node you want to connect to. You can also press C as a shortcut to start/cancel a connection on the selected node.

Canvas tools

• Minimap — bottom-right overview of the whole canvas once your diagram is larger than the visible area; click anywhere on it to jump there.
• Fit Labels — resizes every node so its shape fits its label text, useful after renaming several elements to something longer or shorter.
• Standard zoom/pan — see Keyboard Shortcuts for the full list (+/- to zoom, F to fit the view, Space+drag to pan).

Linking to Attack Trees

An Attack Trees badge in the toolbar shows how many attack trees are currently linked to this DFD, with a dropdown to jump to any of them. See Linking DFDs & Attack Trees for how the link is made.

Import a DFD from code Enterprise

Instead of drawing a DFD by hand, generate one from the configuration that already describes your system. On a forest's page, click Import from code, then upload a file or paste it in. The format is detected automatically:

Before anything is created you get a preview: a small drawing of the diagram, a list of every element with where it came from, and warnings about anything the import couldn't know (for example, resources that aren't diagram elements, like IAM roles). Untick anything you don't want. Unticking a boundary keeps what's inside it. Then name the diagram and click Create diagram. The result is always a new DFD, laid out and ready to edit; it never changes an existing one.

Attack Trees

An Attack Tree decomposes one attacker goal into the specific ways it could be achieved, using AND/OR logic — then lets you score, categorize, and plan a response for each concrete threat at the leaves.

The four node types

Likelihood, Impact, and risk score

On a Goal or Leaf node, set Likelihood and Impact on a 1–5 scale. The risk score is simply Likelihood × Impact (range 1–25), and the editor shows a colored severity badge automatically:

For example, a leaf scored Likelihood 4 × Impact 4 = 16 → Critical; Likelihood 2 × Impact 3 = 6 → Medium.

"Include in risk register"

Every scoreable node has an Include in risk register checkbox. Its default depends on the node:

• A Leaf node with no children (a true terminal point in the tree) defaults to checked — it's assumed to be a concrete, reportable risk.
• Any other node (a Goal, or a Leaf that has further nodes hanging off it) defaults to unchecked.

You can always override the default in either direction — the checkbox reflects your explicit choice once you've touched it, not just the terminal-leaf heuristic.

Threat frameworks All plans

Tag a Goal or Leaf with one or more categories from six threat-classification frameworks. Pick a framework from the dropdown, then a category within it — each tag shows as a colored chip on the node.

MITRE ATT&CK / ATLAS technique mapping

Type one or more technique IDs into the MITRE ATT&CK field (comma-separated, e.g. T1078, T1110.003) or the MITRE ATLAS field (e.g. AML.T0051). Valid-format IDs render as clickable chips that link straight to the official MITRE technique page. This is free-text entry — you look up the technique ID yourself on attack.mitre.org / atlas.mitre.org and paste it in.

Treatment Plan

Record how you're responding to a leaf's risk. Each entry has a type and free-text description:

Standards Controls Pro+

Map a node to specific controls from compliance/security standards — useful for showing an auditor exactly which control addresses which threat. Pick + Add standard, then search within it for the specific control to attach.

Canvas tools

• Auto Layout — automatically re-arranges the whole tree into a clean top-down layout. Handy after freehand-building a tree that's gotten tangled.
• Fit Labels — resizes nodes to fit their current label text.
• Draw connection — same mechanism as the DFD editor: select the parent, click Draw connection (or press C), then click the child.

Linking DFDs & Attack Trees

Linking ties an Attack Tree back to the architecture diagram it's threatening — so your threat model stays traceable to what it's actually describing, not a set of orphaned trees.

How to link

Linking is one-directional in setup but shows on both sides. There are two ways to create the link:

1. From the Attack Tree editor — if the tree isn't linked yet, a Link to DFD ▾ button appears in the toolbar. Click it and pick a DFD tree from the same forest.
2. At creation time — when you create a new tree via Add Tree and choose Attack Tree as the type, an optional Link to DFD dropdown appears right in that modal.

Where the link shows up

• In the DFD editor, an Attack Trees badge in the toolbar shows a count of every attack tree linked to that DFD, with a dropdown to jump straight to any of them.
• An attack tree can be linked to at most one DFD at a time; unlink it the same way you'd change the link, or leave it unlinked if it's exploratory and not tied to a specific architecture yet.

Risk Register

The Risk Register is a forest-wide, auto-populated table of every scoreable finding across every attack tree in the forest — no separate data entry required.

How it's populated

Every Goal/Leaf node across every Attack Tree in the forest with Include in risk register checked (see Attack Trees for the default logic — terminal leaves default to included) shows up here automatically as soon as you save the node. There's nothing to separately "add" to the register.

Columns

Filtering

Four filters at the top of the register, combinable: Filter by tree (narrow to one Attack Tree), Min risk (hide anything below a score threshold), Owner (narrow to a specific assignee), and Status (Mitigated / Not mitigated).

Exporting & Reporting

Four different exports exist, each for a different purpose — a raw diagram export, a machine-readable threat-intel format, and two polished PDF reports for stakeholders.

Risk Register PDF All plans

From the Risk Register page, Export PDF generates a structured, landscape A4 report of the register as it's currently filtered — cover page with severity-count summary, then the full table (threat, attack tree, type, likelihood/impact, risk score & severity, MITRE technique, mitigation count, owner, collaborator). Unlike the forest-level report below, this one is available on every plan, including Free.

From inside an editor (per-diagram)

Open the Export menu in either the DFD or Attack Tree editor:

Forest-level PDF report

From a forest, open Generate Report (available on Pro and Enterprise) to build a full executive-ready PDF covering the whole forest, not just one diagram. Before generating, you set a Report title, a Classification (Confidential / Internal / Public), a Version string, and optional Version notes — all of which land in the report's Document Control section. The generated PDF includes:

• Cover page & document metadata
• Executive summary & risk posture
• Ranked risk register
• Threat analysis, per Attack Tree
• Architecture overview, per DFD
• Controls & standards mapping
• Contributors & activity log
• Appendix & forest metadata

If you've set an organization logo in Settings → Branding, it appears on the report cover — otherwise the report page shows a reminder link to add one.

Live embeds in Confluence and Notion Enterprise

Instead of exporting a PNG and pasting it into your documentation every time a diagram changes, you can embed the diagram itself. An embed is a read-only link that always shows the diagram as it is right now: edit it in ThreatTree and the next time someone opens the Confluence or Notion page, they see the new version.

1. In the forest, click the </> (Embed) icon next to a DFD or Attack Tree, then Create embed link and Copy. Forest owners and editors can do this.
2. Notion: on the page, type /embed, paste the link and choose Embed link. Drag the block's corner to resize it.
3. Confluence Cloud: type /iframe to insert the iFrame macro, paste the link as the URL and set a height (600–800 px works for most diagrams). Confluence Data Center: use the HTML macro (your Confluence admin has to enable it) with <iframe src="LINK" width="100%" height="700"></iframe>.

The embed shows the diagram, its name and when it was last changed. Viewers don't need a ThreatTree account and can't edit anything or see the rest of the forest.

Backup & Restore Pro+

Point-in-time snapshots of a whole forest — every tree, node, edge, and DFD link — that the forest owner can create on demand and roll back to later.

Creating a snapshot

From a forest, the owner-only Backup & Restore button opens the Backup & Recovery panel. Give the snapshot an optional label and click Create snapshot. Manual snapshots are capped at 5 per hour per forest to stop runaway backup creation, and the oldest snapshots are pruned automatically once a forest passes 20 total (manual and automatic combined).

Restoring

Click Restore next to any snapshot in the list. Because this replaces everything currently in the forest, you're asked to re-enter your password to confirm before anything happens. ThreatTree also takes an automatic safety snapshot of the forest's current state immediately before restoring — so a restore is never a one-way trip, even from a snapshot you didn't mean to pick.

Encryption All plans

Forest encryption is genuine client-side, zero-knowledge encryption — ThreatTree's server never sees your plaintext data, and never sees the key either — unless you choose to email yourself a copy (see below).

What "lock a forest" actually does

From a forest's Forest Settings, click Lock & encrypt forest. Your browser then, entirely locally:

1. Generates a fresh AES-256-GCM key using the Web Crypto API (crypto.subtle) — never sent anywhere.
2. Encrypts every diagram name, node label, node property blob, and edge label, tree by tree.
3. Uploads only the resulting ciphertext to the server — replacing the plaintext there.
4. Downloads the key as a .json file to your device. If you ticked Also email me a copy of the key, it's also emailed to your account's address — convenient as a second copy, but that copy passes through ThreatTree's server and your email provider, and anyone who can read that mailbox can decrypt the forest. Leave it unticked for true zero-knowledge encryption.
5. Marks the forest encrypted — every member now sees a lock screen instead of the forest's contents, until someone unlocks it.

What encryption does and doesn't cover

Encrypted: the forest's name and description, every diagram name, node label, node property (likelihood, impact, mitigations, notes and so on) and edge label. Not encrypted, because the diagrams need them to render: the number and types of nodes, their positions, which nodes are connected, and timestamps. Someone with access to the database could see a diagram's shape, but not what any of it says.

Each encrypted value is protected with its own random nonce and authenticated (AES-GCM), so it can't be read or altered without the key. It isn't tied to the node it belongs to, though: someone with database access couldn't read or forge values, but could swap one encrypted label for another. Treat the key file like a password, and keep the forest's regular access controls tight as well.

Unlocking

Anyone who has the key can unlock — either upload the .json key file or paste the base64 key string directly. Unlocking is a one-time action: your browser decrypts the data, uploads the plaintext, and turns encryption off for the whole forest — it's not a personal, per-session unlock. Once unlocked, the forest behaves normally again until someone re-locks it (which generates a brand new key).

Want an email copy after all? On the lock screen, load or paste the key, then use Email this key to me — the same trade-off applies: the key passes through ThreatTree's server and your email provider. This only works if you already have a valid copy of the key; it can't regenerate a lost one.

Collaboration & Organizations

There are two independent ways to share access: inviting individuals to one specific forest, or creating a company Organization that gives everyone on your domain access to every forest owned by the org.

Inviting members to a forest Pro / Enterprise

1. Inside a forest, open Invite Member.
2. Enter their Email address and pick a Role.
3. Click Send invite — they receive an email invitation and appear as "pending" until they accept.

Organizations Pro / Enterprise

An Organization is a bigger, domain-wide alternative to inviting people one forest at a time. Register your company's email domain once, and every forest owned by any member of the organization automatically grants Editor-level access to every other member — no per-forest invites needed.

To give one org member less than Editor on a particular forest, invite them to that forest directly with the Viewer role. A role set on the forest itself replaces the automatic organization access for that forest, so they can still see it but not change it.

1. In Settings → Team, Create your organization using your own company email domain (personal email providers like Gmail/Outlook aren't eligible).
2. Invite teammates by email — they must share the same verified domain.
3. Organizations are seat-limited (set by your plan); the Team panel shows seats used vs. purchased and blocks new invites once you're at capacity.

Organization roles

Every member has one of three roles. The owner can delegate day-to-day team management without handing over the whole organization:

SSO / SAML Enterprise

Enterprise organizations can configure SAML 2.0 single sign-on so members authenticate through your company's identity provider instead of a ThreatTree password. From Settings → Organization Settings, the organization owner configures the IdP's Entity ID, SSO URL, and x509 certificate, and is given the SP metadata/ACS URL to hand to the IdP admin. Once enabled, a Sign in with SSO option appears on the login page — signing in there looks up your email's domain, redirects to your company's IdP, and provisions/links your ThreatTree account automatically on first login.

Microsoft Entra ID (Azure AD)

1. In the Entra admin center: Enterprise applications → New application → Create your own application, then choose "Integrate any other application you don't find in the gallery (Non-gallery)."
2. Open the new app → Single sign-on → SAML.
3. Under Basic SAML Configuration, set Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) to the SP Entity ID and ACS URL shown in ThreatTree's Settings → Organization Settings → SSO.
4. Under Attributes & Claims, edit the Unique User Identifier (Name ID) claim: set the format to Email address and the source attribute to user.mail (or user.userprincipalname if that's what carries your users' real email address).
5. From the SAML Certificates section, download the Certificate (Base64) and copy the Login URL and Microsoft Entra Identifier.
6. Paste those three values into ThreatTree's IdP Entity ID / IdP SSO URL / IdP x509 certificate fields, check Enable SSO for this organization, and save.
7. Under Users and groups, assign whoever should have access — Entra won't let unassigned users through even with a valid domain match.

Okta

1. In the Okta Admin Console: Applications → Create App Integration → SAML 2.0, and name the app (e.g. "ThreatTree").
2. Under Configure SAML, set Single sign-on URL to ThreatTree's ACS URL and Audience URI (SP Entity ID) to ThreatTree's SP Entity ID.
3. Set Name ID format to EmailAddress, and confirm the application username maps to the user's real email.
4. On the app's Sign On tab, click View Setup Instructions to get the Identity Provider Issuer, Identity Provider Single Sign-On URL, and download the X.509 Certificate.
5. Paste those into ThreatTree's IdP fields, enable SSO, and save.
6. On the app's Assignments tab, assign the people or groups who should get access.

Google Workspace

1. In the Google Admin console: Apps → Web and mobile apps → Add app → Add custom SAML app, and name it (e.g. "ThreatTree").
2. Google shows its own SSO URL, Entity ID, and Certificate on this screen — copy those into ThreatTree's IdP fields.
3. On the Service provider details screen, set ACS URL and Entity ID to the values from ThreatTree's Settings → Organization Settings → SSO.
4. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
5. Finish setup, then turn the app ON for everyone or scope it to specific organizational units/groups under User access.
6. Back in ThreatTree, paste Google's values, check Enable SSO for this organization, and save.

SCIM provisioning and IdP groups Enterprise

With SCIM, your identity provider (Okta or Microsoft Entra ID) creates ThreatTree accounts for the people you assign, keeps their names up to date, and removes them from the organization when they're unassigned or deactivated. It can also push groups, so that who can see which forests, and who is an organization Admin, follows group membership in your IdP instead of being re-done by hand in ThreatTree.

The organization owner turns it on in Settings → Organization Settings → SCIM provisioning. Enabling it shows the SCIM base URL and an API token. The token is shown only once, so copy it straight into your IdP. New token issues a replacement and the old one stops working immediately.

Provisioned accounts must use an email address on your organization's domain, and each one takes a seat. People join as Members unless a group mapping (below) makes them Admins.

How pushed groups work

• Each group your IdP pushes appears under Settings → Team → Groups with a From your IdP label. Its name and members are managed in the IdP, so they can't be edited in ThreatTree.
• Give the group access to forests the usual way, from each forest's Members panel. Anyone the IdP adds to the group gets that access; anyone it removes loses it.
• The owner can set Organization role for its members to Admin on a pushed group. Every IdP-provisioned member of that group becomes an organization Admin, and goes back to Member when they leave all Admin-mapped groups. People you invited by hand, and the owner, are never changed by a mapping.
• If a group with the same name already exists in ThreatTree, your IdP can link to it rather than create a new one (Okta's "link group" option). From then on it's managed by the IdP.
• Deleting a pushed group in your IdP deletes it in ThreatTree and removes the forest access it gave.

Okta

1. In your ThreatTree app integration, open General → Edit and set Provisioning to SCIM.
2. On the Provisioning → Integration tab, set SCIM connector base URL to ThreatTree's SCIM base URL, Unique identifier field for users to userName, tick Push New Users, Push Profile Updates and Push Groups, and choose HTTP Header authentication with the API token. Test and save.
3. On Provisioning → To App, enable Create Users, Update User Attributes and Deactivate Users.
4. Assign people on the Assignments tab, then on Push Groups choose the groups to send to ThreatTree.

Microsoft Entra ID

1. In your ThreatTree enterprise application, open Provisioning and set Provisioning Mode to Automatic.
2. Under Admin Credentials, set Tenant URL to ThreatTree's SCIM base URL and Secret Token to the API token, then Test Connection and save.
3. Under Mappings, make sure Provision Microsoft Entra ID Groups is enabled if you want groups pushed.
4. Assign users and groups to the application under Users and groups, then turn Provisioning Status on. Entra provisions in cycles, so changes can take up to about 40 minutes to reach ThreatTree.

IP allowlisting for sign-in Enterprise

Once SSO covers who can sign in, IP allowlisting adds where from: restrict authentication to specific IP addresses or CIDR ranges, on top of password login and SSO alike. From Settings → Organization Settings, the organization owner lists the allowed IPs/ranges (one per line) and enables the restriction. Sign-in attempts from outside the list are rejected — even with the correct password or a valid SSO assertion.

Data retention Enterprise

By default ThreatTree keeps your organization's records for as long as the account exists. Enterprise organizations can instead choose how long each kind of record is kept; anything older is permanently deleted in a daily clean-up. The organization owner sets this in Settings → Organization Settings → Data retention.

Before you save, the form shows exactly how many records the next clean-up would delete, and asks you to confirm if there are any. Each clean-up that deletes something is recorded in the organization activity log with the number of records removed. Deleted forests and diagrams don't need a setting: they're removed straight away when you delete them.

Ticketing sync Enterprise

Enterprise organizations can connect Jira, ServiceNow, Linear, or Azure DevOps so remediation work is tracked where your engineers already work, without a second copy in ThreatTree to keep up to date. Sync works in both directions:

• ThreatTree → ticket: whenever a node is scored High or Critical risk, a ticket is opened in every connected system. This is the same trigger that sends the email alert and, if configured, the Slack/Teams message. The ticket includes the forest name, the node's label, the risk score, and a link back into ThreatTree. If a risk dips below High and comes back while its ticket is still open, no duplicate ticket is created.
• Ticket → ThreatTree: when the ticket is closed, the risk is marked Mitigated in the Risk Register. If the ticket is reopened, the risk goes back to open. If a mitigated risk is later scored High or Critical again, a new ticket is opened.

Set it up from Settings → Integrations → Ticketing sync (organization owner only). Click Connect next to a provider, fill in its fields, tick Create tickets and sync their status, and save. Saving tests the connection against the live system first, so a mistyped token or project is caught immediately, not later when a real risk silently fails to open a ticket. Credentials are stored encrypted and never shown again after saving; leave the credential field blank on later saves to keep the stored one.

How status gets back to ThreatTree

ThreatTree checks linked tickets' statuses automatically about every 15 minutes, with no setup on your side. Each round checks up to 100 tickets per connected system, starting with the ones checked least recently, so a very large backlog is covered over a few rounds. Each provider row in Settings also has a Sync now button that checks every ticket straight away and reports how many changed.

For instant updates, you can also point your ticketing system at the status webhook URL shown after you first save a provider:

• Jira: Settings → System → WebHooks → Create a WebHook. Paste the URL and tick Issue → updated. Optionally, add a JQL filter such as labels = threattree, since every ticket ThreatTree opens carries that label.
• Linear: Settings → API → Webhooks → New webhook. Paste the URL and select Issues.
• Azure DevOps: Project settings → Service hooks → + → Web Hooks, trigger Work item updated. Paste the URL.
• ServiceNow has no built-in outbound webhook. Add a Business Rule on the table (When: after, Update; Advanced ticked; condition Active changes or State changes) with this script:

(function executeRule(current, previous) {
  var r = new sn_ws.RESTMessageV2();
  r.setEndpoint('PASTE_THE_WEBHOOK_URL_HERE');
  r.setHttpMethod('post');
  r.setRequestHeader('Content-Type', 'application/json');
  r.setRequestBody(JSON.stringify({ sys_id: current.getUniqueValue(), number: current.getValue('number') }));
  r.executeAsync();
})(current, previous);

The webhook only tells ThreatTree which ticket changed. ThreatTree then reads that ticket's real status back from your ticketing system with the saved credential, so a forged or replayed webhook call can't mark anything mitigated. Even so, treat the URL like a password: if it leaks, use Regenerate to invalidate it, then paste the new one into your ticketing system.

SIEM feed Enterprise

Enterprise organizations can push a STIX 2.1 feed of every forest with an attack tree to Splunk, so a security team's SIEM stays continuously up to date instead of relying on someone remembering to re-run the manual "Download STIX 2.1" export. From Settings → Integrations, the organization owner enters a Splunk HTTP Event Collector (HEC) URL and token. Saving tests the connection immediately, and once enabled the feed is pushed automatically about once an hour. A Push now button sends an immediate feed, so you can confirm it's working right away rather than waiting for the next hourly push. The Last pushed time under the form shows when the most recent push happened.

Currently Splunk only — Microsoft Sentinel isn't yet supported, since its ingestion APIs need a full Microsoft Entra ID app registration rather than a simple token. Each push sends one STIX 2.1 bundle per forest as a single event, covering every attack tree in that forest; forests with no attack tree yet are skipped. Create your HEC token from Splunk's Settings → Data Inputs → HTTP Event Collector.

GRC evidence sync Enterprise

Enterprise organizations can send their threat-model evidence to Vanta or Drata on a schedule, instead of exporting PDFs by hand before every audit. ThreatTree attaches one dated PDF per push to a document in Vanta or a control in Drata. It contains:

• every forest owned by a member of your organization, with its owner and whether it's client-side encrypted;
• the risk register of each forest: threat, likelihood, impact, risk score, status (Mitigated when every ticket linked through ticketing sync is closed), mitigations, mapped standards controls (ISO 27001, SOC 2…) and risk owner;
• the organization's audit-log events since the previous push (the last 30 days for the first one), up to the 1,000 most recent.

Encrypted forests are listed but their contents aren't included: they're encrypted in your browser, so ThreatTree can't read them. The organization owner sets this up in Settings → Integrations → GRC evidence sync. Saving tests the connection straight away. Evidence is then sent weekly or monthly, whichever you pick, and Push now sends a file immediately. If a scheduled push fails, ThreatTree tries again about an hour later, and the error is shown under the form.

Vanta:

1. In Vanta, open the document (evidence request) the file should go to, for example a custom document called "Threat model and risk assessment", and copy its ID.
2. In Vanta's Developer Console, create a Manage Vanta application and copy its client ID and client secret. ThreatTree requests the vanta-api.all:read, vanta-api.all:write and vanta-api.documents:upload scopes.
3. In ThreatTree, choose Vanta, paste the client ID, client secret and document ID, tick Enable and save.

Each push uploads the PDF to that document and submits it, so it's visible to your auditor.

Drata:

1. In Drata, create an API key under Settings → API Keys with read access to controls and write access to control evidence.
2. Find the numeric ID of your workspace and of the control the evidence belongs to (for example your risk-assessment control). Use the control's numeric ID, not its code.
3. In ThreatTree, choose Drata, paste the API key, workspace ID and control ID, tick Enable and save.

Each push adds the PDF to the control as external evidence. Its renewal date is set one month ahead for weekly pushes and two months ahead for monthly ones, so it never shows as expired between pushes. Drata's US-hosted API (public-api.drata.com) is used.

Audit logs Pro+

Pro and Enterprise forests keep an audit trail of member activity — invites, role changes, tree/node/edge creation and deletion, encryption lock/unlock, and more — viewable per forest, filterable by category.

Settings & Account

Everything about your own account and org-wide branding lives under the avatar menu → Settings, split into eight tabs.

Two-factor authentication

Settings → Security lets you require a second step at sign-in, on top of your password. Two methods are available, and only one can be active at a time:

1. In Settings → Security, click Enable next to the method you want and confirm your password.
2. For the authenticator app: scan the QR code (or type the key shown below it into your app manually), then enter the 6-digit code your app generates to confirm setup.
3. The first time you turn on either method, you're shown 10 backup codes — save them somewhere safe. Each works once, as a way back into your account if you lose your phone or email access. Use Regenerate any time to invalidate the old set and get a fresh 10.

Billing & Seats

Everything about paying for ThreatTree is self-serve, from Settings → Membership & Billing (or the plans page).

• Upgrading — pick Pro, choose how many seats you're buying (1 if it's just you), and you're taken to a Stripe Checkout page. If you buy more than one seat, a company Organization is created for you automatically once payment succeeds — see Organizations.
• Managing payment — Manage billing opens Stripe's hosted billing portal to update your card, view past invoices, or cancel.
• Changing seat count — the organization owner can raise or lower the seat count at any time. Before confirming an increase, ThreatTree shows the exact prorated amount Stripe is about to charge; if that charge fails (e.g. insufficient funds), the seat count is left unchanged rather than granting seats that weren't paid for. Lowering seats can't drop below the number of seats currently in use.

Account lockout after failed sign-ins

After 5 consecutive failed password attempts against your account, sign-in is temporarily blocked for 15 minutes — even if a later attempt uses the correct password. This protects against someone repeatedly guessing your password, and applies per account regardless of which device or network the attempts come from.

The lockout clears itself automatically 15 minutes after the last failed attempt; there's no manual unlock needed. A single successful sign-in also resets the count immediately.

⌨️ Keyboard Shortcuts

Both the DFD and Attack Tree editors share the same shortcut set — also available any time from the ? button next to the zoom controls.