Cyber Monday20% off Pro for your first 3 months. First 50 customers.

Threat modeling software pricing

Start free with up to three systems. Move to Pro when your team needs unlimited models, compliance mapping and reports, and pay only for the people who edit.

  • Free foreverNo credit card, no trial clock
  • Viewers are free3 per paid seat, for readers and auditors
  • Monthly billingChange seats or cancel any time

Free

$0forever

For one person and up to three systems

The full modeling toolset, capped in size. Model your main system, a side project and a practice environment.

Get started free

No credit card, no trial clock

  • What's included
  • Up to 3 forests, 3 DFDs per forest and 5 attack trees per DFD
  • Data flow diagrams and attack trees with AND/OR logic
  • The attack tree generator: draft trees from your DFD
  • STRIDE, LINDDUN, OWASP Top 10, CAPEC and MITRE ATT&CK tags
  • A scored risk register with PDF export
  • Finished example threat models to open and learn from
  • Optional AES-256-GCM forest encryption, with a key only you hold
Most popular

Pro

$29per editor / month

Billed monthly. Viewers are free.

For teams that threat model every system they run, and need to show their work to auditors and the board.

Get started with Pro

Create your account, then straight to checkout

3 free viewers per seat for developers, reviewers and auditors who only need to read.
  • Everything in Free, plus
  • Unlimited forests, DFDs and attack trees
  • Compliance mapping: ISO 27001, NIST SP 800-53, NIST CSF 2.0, CIS v8, ASVS, PCI DSS, SOC 2, NIS2 and DORA
  • Team collaboration: forest roles and a company organization
  • Board-ready forest PDF report and STIX 2.1 export
  • Industry Modules for automotive, medical devices, fintech, healthcare, critical infrastructure, SaaS and AI & ML
  • 7 finished industry templates
  • Backup and restore, audit logs, Slack and Teams alerts
  • Priority support

Enterprise

Custom

Quote within 24 to 72 hours

For large organizations that need single sign-on, integrations with their ticketing and GRC tools, and their own deployment.

Get a quote

No commitment

  • Everything in Pro, plus
  • SSO with SAML 2.0 and SCIM provisioning
  • IP allowlisting, custom roles and data retention policies
  • Import DFDs from Terraform, CloudFormation and OpenAPI
  • Jira, ServiceNow, Linear and Azure DevOps ticket sync
  • Splunk feed and Vanta or Drata evidence sync
  • Live Confluence and Notion embeds
  • Linked organizations: one summary view across subsidiaries or clients
  • Dedicated or VPC deployment, dedicated support and an SLA
Prices in US dollars, before any sales tax Already a customer? Manage your plan and seats
Team cost

What would Pro cost your team?

Count the people who will draw diagrams, build attack trees or score risks. Everyone who only reads the model, such as developers, reviewers and auditors, can be a free viewer.

Your team on Pro$145 / month

  • 5 paid seats × $29$145
  • 10 viewersFree
  • Room for more free viewers5
Get started with Pro
Compare plans

Every feature, by plan

Free has the full modeling toolset, just capped in size. For what each feature does, see all features.

FeatureFreeProEnterprise
Price and limits
Price$0$29 per editor / monthOn request
Free view-only seats—3 per paid seat3 per paid seat
Forests (systems)3UnlimitedUnlimited
DFDs per forest / attack trees per DFD3 / 5UnlimitedUnlimited
Modeling
Data flow diagrams, attack trees, risk register✓✓✓
Attack tree generator✓✓✓
STRIDE, LINDDUN, OWASP Top 10, CAPEC, MITRE ATT&CK✓✓✓
Finished example threat models✓✓✓
Industry Modules and the 7 industry templates—✓✓
Import DFDs from Terraform, CloudFormation, OpenAPI——✓
Compliance and reports
Risk register PDF and JSON export✓✓✓
Compliance standards mapping—✓✓
Board-ready forest PDF report, STIX 2.1 export—✓✓
Backup and restore snapshots—✓✓
Team
Forest roles and company organizations—✓✓
Audit logs—✓✓
Slack and Teams critical-risk alerts—✓✓
Security and integrations
Client-side AES-256-GCM encryption, two-factor sign-in✓✓✓
SSO / SAML, SCIM, IP allowlisting, custom roles——✓
Jira, ServiceNow, Linear, Azure DevOps sync——✓
Splunk feed, Vanta and Drata evidence sync——✓
Live Confluence and Notion embeds——✓
FAQ

Pricing, answered

Seats, limits, billing and what happens if you stop paying.

Still have questions?

We usually reply within a day.

Get in touch
Do I need a credit card to start?

No. The Free plan needs only an email address, and it isn't a trial: it stays free for as long as you use it. You only enter card details if you choose Pro, on Stripe's secure checkout page.

Who needs a paid seat?

Anyone who can edit a threat model uses a paid seat, including editors invited from outside your organization. People who only read get free view-only seats: up to 3 per paid seat. Viewers can open every forest they're given and download reports, but can't change anything.

How does seat billing work?

Pro is billed monthly per seat. The organization owner can add or remove seats at any time from Settings. Adding seats charges the prorated amount for the rest of the month straight away, and ThreatTree shows the exact amount before you confirm. Removing seats takes effect without a refund for the current month, and you can't go below the number of seats in use.

What happens when I reach the Free plan limits?

You see a message explaining the limit. Everything you've already built stays fully accessible and editable; only creating new forests, DFDs or attack trees beyond the limit is blocked until you upgrade.

What happens if I cancel or downgrade?

Your forests aren't deleted. You keep access to everything you built, and you can export any diagram as JSON and the risk register as a PDF at any time. On Free you can't create new forests beyond the Free limits until you upgrade again. You cancel from the Stripe billing portal, linked from Settings.

Is there a free trial of Pro?

There's no timed trial. The Free plan has the full modeling toolset, so you can judge the editors, the attack tree generator and the risk register before paying. To evaluate Pro features with your team, email hello@threattree.com.

How quickly do I get an Enterprise quote?

Within 24 to 72 hours of your quote request. Enterprise pricing depends on the number of users, the integrations you need and whether you want a dedicated deployment.

How do I pay?

By card through Stripe. Invoices and payment details are in the Stripe billing portal, which you open from Settings, Membership and Billing.

Free planWhat you get for free → CompareThreatTree vs other tools → Buyer's guideBest threat modeling software in 2026 →

Model your first system today

Free plan, no credit card. Upgrade when your team is ready.

Get started free See all features