STRIDE threat modeling tool, on a real system diagram
STRIDE threat modeling asks six questions of every part of a system: can someone spoof it, tamper with it, deny what they did, read what they should not, take it down, or gain privileges through it? Draw your system (or seed a starting diagram from a URL or a short description), then get AI-suggested STRIDE (or LINDDUN) threats per element, each scored and tied to a mitigation and a control citation from NIST 800-53, CIS Controls v8, ISO 27001 or PCI DSS 4.0.
What it gives you
System diagram canvas
Add processes, data stores, actors, external systems and trust boundaries, then drag connections between them to map how data actually flows.
Seed from a URL or a description
Paste a public site URL — it reads the page’s security headers and third-party calls and infers a starting diagram, without storing the page — or describe the system in a sentence and let AI draft it.
AI-suggested STRIDE or LINDDUN threats
Select an element and get threats scored qualitatively, by CVSS, or by DREAD, each with a mitigation and a control citation from NIST 800-53, CIS Controls v8, ISO 27001 or PCI DSS 4.0 — plus MITRE ATT&CK and CWE references where relevant.
Trust-boundary crossing checks
Mark trust boundaries and run an analysis that flags which data flows cross them, so a boundary you drew is more than decoration.
Disposition & residual risk
Mark each threat open, mitigated, accepted, transferred or avoided, with an owner and review date, and record the residual risk once a control is in place.
Exports that keep the work
PNG or SVG of the diagram, the full model as JSON, a CSV threat register, and a printable PDF threat register.
How it works
- 1Add elements to the canvas — processes, data stores, actors, external systems, trust boundaries — or seed a starting diagram from a URL or a short description.
- 2Classify each element’s data (public through confidential, PII, PHI, PCI, secret) and draw the data flows between them; run the boundary check to flag flows crossing a trust boundary.
- 3Select an element and hit “Suggest STRIDE threats” (or switch to LINDDUN) to get AI-suggested threats with likelihood/impact, a mitigation, and a control citation.
- 4Set each threat’s disposition, track residual risk, and export the diagram and threat register as PNG, SVG, JSON, CSV or PDF.
Honest about what this is
- A real diagramming canvas for threat modeling a system, alone or in a workshop, with threats grounded in named control frameworks rather than a generic checklist.
- Pro is $5/month or $40/year.
- ✕ Not an automated scanner of your live infrastructure — the URL seed only reads what a public page’s headers and network calls reveal; everything else on the canvas is what you draw.
- ✕ The AI-suggested threats and control citations are a fast first pass to review and adjust, not a certified assessment.
FAQ
What is STRIDE threat modeling?
STRIDE is a threat modeling method from Microsoft that checks each part of a system for six kinds of threat: Spoofing (pretending to be someone else), Tampering (changing data or code), Repudiation (denying an action with no proof), Information disclosure (data leaking), Denial of service (making it unavailable) and Elevation of privilege (gaining rights you should not have). You draw the system as a data flow diagram, then ask the six questions of every process, data store, data flow and trust boundary.
What does a STRIDE threat modeling example look like?
Take a login page that calls an API backed by a user database. Spoofing: a stolen session cookie lets an attacker act as a user (mitigation: short-lived, bound sessions and MFA). Tampering: a request is changed in transit (TLS and server-side validation). Repudiation: an admin deletes records and nothing records who did it (tamper-evident audit logs). Information disclosure: the API returns other users' records (object-level authorisation). Denial of service: the login endpoint is flooded (rate limiting). Elevation of privilege: a normal user reaches an admin route (role checks on every call). The studio produces this kind of list for each element you draw.
STRIDE or LINDDUN: which should I use?
STRIDE finds security threats; LINDDUN finds privacy threats (linking, identifying, non-repudiation, detecting, data disclosure, unawareness and non-compliance). Use STRIDE for most systems and add LINDDUN where the system processes personal data. The studio can suggest either for any element.
What does Threat Model Studio actually do?
You build a system diagram — processes, data stores, actors, external systems and trust boundaries, connected by data flows — either by hand, from a pasted URL, or from a short text description. Select any element and it suggests STRIDE (or LINDDUN) threats scored by likelihood and impact, CVSS, or DREAD, each with a mitigation and a citation into a real control framework.
Is it free?
It needs Pro, $5/month or $40/year.
What does "real control citations" mean?
Each suggested threat’s mitigation is tied to a specific control ID from a named framework — NIST 800-53, CIS Controls v8, ISO/IEC 27001, or PCI DSS 4.0 — plus a MITRE ATT&CK technique ID and/or a CWE ID where one applies, instead of a generic "add a firewall" suggestion.
What happens when I seed a diagram from a URL?
It fetches the public page, reads its security headers and third-party calls, and infers a high-level starting diagram from that. The page itself isn’t stored — you’re expected to correct and extend whatever it produces.
What can I export?
The diagram as PNG or SVG, the full model as JSON, the threat register as CSV, and a printable PDF threat register.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.