<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-threat-modeling-tools-comparison
description: >-
  Evaluate and compare threat modeling tools against team requirements.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - tools-comparison
  - microsoft-tmt
  - threat-dragon
  - pytm
  - iriusrisk
  - threagile
  - tool-selection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1195"
  - "T1199"
---

# Implementing Threat Modeling Tools Comparison

## Overview

Selecting the right threat modeling tool impacts team adoption, automation capabilities, and
integration with existing SDLC workflows. This technique provides structured evaluation of
major threat modeling tools across feature sets, automation support, CI/CD integration,
scalability, and cost.

Mode: `[MODE: ARCHITECT]` — Tool evaluation and selection for threat modeling programs.

## Prerequisites

- Understanding of team size, workflow requirements, and budget
- Existing SDLC/CI/CD pipeline details
- Python 3.10+

## Key Concepts

### Tool Comparison Matrix

| Tool | Type | DFD | STRIDE | CI/CD | Cost | Collab |
|------|------|-----|--------|-------|------|--------|
| **Microsoft TMT** | Desktop | Visual | Built-in | Limited | Free | File-based |
| **OWASP Threat Dragon** | Web/Desktop | Visual | Manual | GitHub | Free | Git-based |
| **pytm** | Code (Python) | Generated | Automated | Native | Free | Code review |
| **IriusRisk** | SaaS | Visual | Automated | API/Plugin | Paid | Web-based |
| **Threagile** | Code (YAML) | Generated | Automated | Native | Free | Code review |

### Selection Criteria

| Criterion | Weight | Description |
|-----------|--------|-------------|
| **Automation** | High | Threat enumeration without manual effort |
| **SDLC Integration** | High | CI/CD pipeline compatibility |
| **Collaboration** | Medium | Multi-user editing and review workflows |
| **Learning Curve** | Medium | Time to productive use |
| **Customization** | Medium | Custom threat rules and templates |
| **Output Quality** | High | Report generation and export formats |
| **Scalability** | Medium | Handles large, complex architectures |

## Workflow

### Step 1: Assess Requirements

```bash
node scripts/agent.js --action assess --input requirements.json
node scripts/agent.js --action compare
```

### Step 2: Score and Rank

```bash
node scripts/agent.js --action score --input requirements.json
```

### Step 3: Generate Recommendation

```bash
node scripts/agent.js --action report --input requirements.json --output report.json
```

## Verification

- [ ] Team requirements documented (size, workflow, budget, existing tools)
- [ ] At least 3 tools evaluated against weighted criteria
- [ ] Proof-of-concept completed with top 2 candidates
- [ ] Integration tested with existing CI/CD pipeline
- [ ] Total cost of ownership calculated (licensing + training + maintenance)
- [ ] Recommendation documented with justification and migration plan

## References

- [Microsoft Threat Modeling Tool](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)
- [OWASP Threat Dragon](https://owasp.org/www-project-threat-dragon/)
- [pytm — Pythonic Threat Modeling](https://github.com/OWASP/pytm)
- [Threagile — Agile Threat Modeling](https://threagile.io/)
- [IriusRisk](https://www.iriusrisk.com/)
