Compare
Free is the right answer until the threat model has to connect to anything. Threat Dragon is the best free canvas; Alvor is the program it graduates into.
Scope at a glance
Alvor
9 of 9 · one graph
Threat Dragon
0 of 9 · 1 partial
Read from OWASP Threat Dragon's docs, July 2026: data flow diagramming and threat recording per model file. Partial means lighter-weight or adjacent coverage rather than a dedicated module. Spot something out of date? Tell us and we will fix it.
The quick verdict
Choose Alvor when
Choose Threat Dragon when
The bigger picture
OWASP Threat Dragon is a free, open-source threat modeling tool (Apache 2.0, OWASP production status) for drawing data flow diagrams and recording threats. Excellent for individuals; it stops where a program begins.
Threat Dragon deserves its place: it is a free, Apache 2.0-licensed OWASP project with production status, it runs as a web app, a desktop app, or a Docker image, it supports five threat frameworks (STRIDE, LINDDUN, CIA, DIE, PLOT4ai), and its rule engine will suggest threats and mitigations against your data flow diagram. For an engineer learning threat modeling, or a single team keeping models next to the code, we recommend it without hedging. It costs nothing and it teaches the right discipline.
The honest limit is that a threat model in a JSON file is knowledge, not governance. Nothing accumulates: each model starts from scratch rather than from a shared, deduplicating threat library. Nothing connects: a mitigation in Threat Dragon is a text field, not a control that becomes a build requirement, a risk register entry, and audit evidence. Nothing is governed: no approvals, no sign-off trail, no coverage across projects, and even Threat Dragon's own v1 and v2 file formats are incompatible with each other, let alone with other tools. Alvor keeps the same STRIDE discipline and puts it on the program graph: the AI studios draw the diagram and propose the model in reviewable batches, your libraries do the enumerating, your control catalog does the mitigating, and the outputs land where auditors and boards actually look.
The graduation moment is predictable: a second team starts modeling, or an auditor asks how design risk is managed, or a customer security review wants proof. That is when free stops being cheap, because the integration and re-entry work lands on your team. Start on Threat Dragon with our blessing. When the threat model has to connect to something, that is Alvor.
See the capability itself: threat modeling in Alvor and AI threat modeling.
Side by side
Plain-text descriptions, no checkmark games. If we can't say it, we don't.
Capability
Alvor
Threat Dragon
Primary category
Alvor
Unified security architecture management and compliance platform; threat modeling lives inside the Secure by Design module
Threat Dragon
Free, open-source threat modeling tool (OWASP project, Apache 2.0)
Cost and license
Alvor
Commercial SaaS. Flat annual price scoped to company size, all eight modules in every plan.
Threat Dragon
Free forever; Apache 2.0 open source.
Scope
Alvor
Eight integrated modules: asset management, secure by design (security architecture), risk, compliance, policy, program, third-party risk, and business continuity, plus an embedded AI assistant.
Threat Dragon
Data flow diagramming and threat recording for individual models.
Methodologies
Alvor
STRIDE-centric register with MITRE ATT&CK and Cyber Kill Chain references on every threat.
Threat Dragon
STRIDE, LINDDUN, CIA, DIE, and PLOT4ai selectable per diagram.
Threat generation
Alvor
Library-first AI proposals (MITRE ATT&CK, OWASP, CAPEC, NIST seeds) anchored to diagram elements, one approval card per batch.
Threat Dragon
Built-in rule engine suggests threats and mitigations; manual entry otherwise.
Storage and collaboration
Alvor
Shared platform: roles, permissions, batch approvals, coverage analytics, full audit trail.
Threat Dragon
JSON files stored locally or in a repository; v1.x and v2.x formats are mutually incompatible.
Downstream GRC
Alvor
Native: mapped controls become build controls, findings escalate to the risk register, evidence flows into compliance.
Threat Dragon
None; mitigations are recorded text, and anything downstream is manual.
AI capabilities
Alvor
Agentic studios draw the diagram from a description or photo and propose the threat model, on your own model provider, approval-gated and audit-logged.
Threat Dragon
No AI features.
Deployment
Alvor
SaaS.
Threat Dragon
Web application, desktop installers (Linux, macOS, Windows), or Docker; fully self-hostable.
Support
Alvor
Vendor support with response-time commitments per plan, plus guided onboarding.
Threat Dragon
Community support through the OWASP project.
Comparison based on each product's publicly described scope at the time of writing. Capabilities and pricing may change; we update this page when we notice. If something here is out of date, write to us and we'll fix it.
Questions
Common questions security leaders ask while shortlisting.
Genuinely, yes. It is a free, Apache 2.0 OWASP project with production status, it runs as a web app, desktop app, or Docker image, it supports STRIDE, LINDDUN, CIA, DIE, and PLOT4ai, and its rule engine suggests threats and mitigations automatically. For learning threat modeling, or for a single team keeping models beside the code, it is the best free option available and we recommend it sincerely.
Get started
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.