A free threat modelling tool for architecture designs
SecArch turns an architecture design into a threat model you can review, score and hand over. It runs in your browser, so your files stay on your device.
Start from the design you already have
Import a draw.io or Visio diagram, a Word, PowerPoint, PDF, Markdown or text document, or an image of a diagram. SecArch lists the components, connections, trust zones and data it finds, and marks each item unconfirmed until you check it. You can also draw the design on the built-in canvas.
Three methods, one model
- STRIDE per element. Threats are generated for every component and data flow, with a coverage view that shows what has and has not been considered.
- PASTA. An attack-centric, seven-stage view of the same design.
- OCTAVE Allegro. An asset-centric view for teams that start from what must be protected.
Each threat includes threat actors, use cases and abuse cases, with MITRE ATT&CK and ATLAS references, and a risk score you can read and challenge.
Reports you can hand over
- The design review and the threat model as PDF documents.
- The requirements and the threat register as Excel workbooks with live risk formulas.
- The project file, so you can reopen the work later.
What it does not do
SecArch reviews what a design says. It does not scan live systems or test anything. Results are repeatable: the same design always gives the same result, and a fact that is missing stays unknown rather than assumed. AI assistance is optional and off by default. If you switch it on, you bring your own key or use a model on your own computer.
Questions
Is it free? Yes. The web app needs a free account. The desktop app needs none.
Does my design leave my computer? Not unless you turn on AI assistance and choose a hosted provider. Read the privacy notice.
See also the security architecture review side of SecArch.