OWASP Threat Dragon
OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application used to draw threat modeling diagrams and to list threats for elements in the diagram.
Threat Dragon is designed to be accessible, with an emphasis on flexibility and simplicity. It supports multiple threat modeling frameworks including STRIDE, CIA, LINDDUN, and more.
You can run Threat Dragon as a standalone desktop application or a fully featured, configurable, self-hosted web application.
There are multiple resources available to help you on your threat modeling journey!
Documentation: https://www.threatdragon.com/docs/
Introduction to Threat Dragon (courtesy of the OWASP Spotlight series): https://www.youtube.com/watch?v=hUOAoc6QGJo
Threat Modeling Gamification seminar by Vlad Styran (making threat modeling fun!): https://www.youtube.com/watch?v=u2tmLrwv-nc
Join the #project-threat-dragon channel in OWASP's Slack Workspace: https://owasp.slack.com/archives/CURE8PQ68
You need to join the OWASP Slack workspace first: https://owasp.org/slack/invite
The resources below are general threat modeling resources - not specific to Threat Dragon.
Mike Goodwin authored the first version of Threat Dragon. Version 2 came about after angularjs, the frontend framework used to develop Threat Dragon, became end of life. Threat Dragon was written in vuejs, and the graphing library @antv/x6 was selected to replace the end of life graphing library.
If you are using version 1 of Threat Dragon, we recommend upgrading to version 2 for compatibility and security reasons. The following resources are applicable only to version 1.
Mike Goodwin's lightning demo (v1) at OWASP Open Security Summit in June 2020: https://www.youtube.com/watch?v=n6JGcZGFq5o
Version 1 documentation: https://threatdragon.github.io/
Project Resources
Project Leaders
Mike Goodwin
Leader & Original Author
The original creator of Threat Dragon way back in October 2015 and selected the famous Cupcake project logo; used by Threat Dragon with the kind permission of the artist DЯΣΛMƧVΣЯƧΣ
Jon Gadsden
Project Leader
Jon is a leader for the OWASP Threat Dragon and Developer Guide projects. For some years he was an OWASP Chapter leader for Bristol, England, and still helps out with organising these chapter meetings.
Project Information
Slack