OWASP Threat Dragon

[][build] [][latest]

[][practices]

OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram. Mike Goodwin (opens in a new tab) created Threat Dragon as an open source community project that provides an intuitive and accessible way to model threats.

Threat Dragon is designed to be accessible for various types of teams, with an emphasis on flexibility and simplicity. The Project has OWASP Production status and follows the values and principles of the threat modeling manifesto.

This program is free software: you can redistribute it and/or modify it under the terms of the Apache 2.0 License.

Try Threat Dragon

Access the latest version of Threat Dragon on the demo website and refer to the documentation pages.

Also well worth watching the video provided by the OWASP Spotlight (opens in a new tab) series.

The github release area contains Threat Dragon from version 1.3 to the latest versions 2.x. Previous releases are from Mike Goodwin's original repository (opens in a new tab).

About Threat Dragon

There is a good overview of from OWASP, and this expands on what the Threat Dragon project aims for:

• ease of use and accessible
• designing a data flow diagram
• suggesting threats
• entering mitigations and counter measures

Mike Goodwin (opens in a new tab) is the founder and creator of this project, and this repository has been migrated from Mike Goodwin's original (opens in a new tab) which has the issues and pull requests from October 2015 up to June 2020.

Threat Dragon is primarily a web application (opens in a new tab). The web application can store threat model files on the local filesystem; in addition access can be configured for :

• GitHub
• Bitbucket
• GitLab
• Github Enterprise

The desktop versions (opens in a new tab) of Threat Dragon stores the threat model files on the local filesystem and do not access external repositories. You can download installers (opens in a new tab) for Windows, MacOS and Linux.