OWASP SecOpsTM

WASP SecOpsTM is an open-source threat modeling as code framework. You write your system model as a Markdown file that is easy to read and keep under version control, or you generate it from Ansible, Terraform or Docker Compose. SecOpsTM then runs a complete threat analysis on it.

What it does

• Finds threats automatically: STRIDE threats for every component, trust boundary and dataflow, built on the latest release of OWASP pytm.

• Gives real-world context: each threat is mapped to MITRE ATT&CK, CAPEC and CWE, with mitigations from D3FEND, CIS Controls, NIST 800-53 and OWASP ASVS.

• Scores risk realistically: severity takes into account CVEs (from VEX or CycloneDX BOM), weak CWEs, network exposure, data classification and the mitigations you already have in place.

• Shows how an attacker gets in: attack chains across dataflows, plus goal-driven attack flows (GDAF) that go from threat-actor profiles to your critical assets.

• Produces usable outputs: an interactive HTML report with an executive view, versioned JSON, SARIF, STIX 2.1, an ATT&CK Navigator layer, Attack Flow files, a remediation checklist and interactive diagrams.

• Uses AI only if you want it: per-component LLM threats, a local RAG knowledge base, SOC detection rules (Sigma, SPL, KQL), a CISO briefing and a Red/Blue debate on attack scenarios. Any LiteLLM provider works, or Ollama fully offline. Without AI, everything still runs offline.

How you use it

• CLI: secopstm --model-file model.md

• CI/CD: a GitHub Action and a severity gate that fails the build on new HIGH or CRITICAL threats

• Web editor: secopstm --server for live editing with a diagram preview

• Docker: docker run -p 127.0.0.1:5000:5000 ellipse2v/secopstm:latest

Who it is for

Security architects, DevSecOps teams and developers who want threat models that stay in sync with the architecture and run on every change, not just a diagram drawn once.

Links

• Source code: https://github.com/ellipse2v/SecOpsTM