OWASP Threat Dragon
OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application used to draw threat modeling diagrams and to list threats for elements in the diagram.
Threat Dragon is designed to be accessible, with an emphasis on flexibility and simplicity. It supports multiple threat modeling frameworks including STRIDE, CIA, LINDDUN, and more.
You can run Threat Dragon as a standalone desktop application or a fully featured, configurable, self-hosted web application.
We appreciate greatly all our contributors: without their open-source contributions Threat Dragon would be long-gone. There are some individuals and teams that have come forward to make an ‘above and beyond’ difference to Threat Dragon, and here they are:
A team from the Universidad Católica del Uruguay (UCU) took part in a Coding Challenge to provide integration between Cornucopia and Threat Dragon. In addition they made it extensible so that other EoP-type cards can be integrated into Threat Dragon.
We are very grateful and look forward to more contributions to the open-source community:
Anthony Pereira (Clarensedor)
Belén Bulla (bbulla)
Belén de Oliveira Madeira (beldomadeira)
Chris Bentancor (ChrisBentancor)
Diego Gamarra (gamarradiego)
Emanuel Fraga (FragaEmanuel)
Gaspar Lamas (gasparlamas)
Guillermo Guerrico (GuilleGuerrico098)
Javier Moreno (javiermorenov1203)
and many thanks to Gerardo Canedo (gerardocanedoUCU) for making this happen
Mohamed El-Bohy (mohamedselbohy) devoted his summer of 2024 to completing the Threat Dragon functionality. When Threat Dragon moved from version 1.x to version 2.x it was not feature complete, and Mohamed implemented these final features for Threat Dragon.
Leo Reading (lreading) travelled the long road of migrating Threat Dragon from AngularJS + JointJS to Vue + antv/x6. This ensured that Threat Dragon made it to version 2.x, otherwise Threat Dragon would be swamped with unsupported dependencies.
Project Resources
Project Leaders
Mike Goodwin
Leader & Original Author
The original creator of Threat Dragon way back in October 2015 and selected the famous Cupcake project logo; used by Threat Dragon with the kind permission of the artist DЯΣΛMƧVΣЯƧΣ
Jon Gadsden
Project Leader
Jon is a leader for the OWASP Threat Dragon and Developer Guide projects. For some years he was an OWASP Chapter leader for Bristol, England, and still helps out with organising these chapter meetings.
Project Information
Slack