Threat modeling is a structured way to ask “what can go wrong?” with a system’s design. You diagram how data flows, draw trust boundaries, then systematically enumerate threats and mitigations. OWASP Threat Dragon is a free, open-source threat-modeling tool that pairs data-flow diagrams with the STRIDE methodology and generates a shareable report.
Opens the official Threat Dragon web app in a new tab. The “Demo” option works with no account — your model stays in your browser.
Violates: Authentication
Pretending to be another user, component, or system to gain trust you shouldn't have.
e.g. Forged JWT, stolen session cookie, or a rogue service impersonating your API.
Violates: Integrity
Modifying data or code in transit or at rest without authorization.
e.g. Altering a price in a request body, or patching a binary on disk.
Violates: Non-repudiation
Performing an action and then denying it, with no reliable evidence to prove otherwise.
e.g. A user disputes a transaction because there are no tamper-proof audit logs.
Violates: Confidentiality
Exposing data to people or systems not authorized to see it.
e.g. Verbose errors leaking stack traces, or an open S3 bucket of PII.
Violates: Availability
Degrading or denying service to legitimate users.
e.g. Unbounded request loops, resource exhaustion, or a volumetric flood.
Violates: Authorization
Gaining capabilities beyond those originally granted.
e.g. An IDOR that lets a standard user reach admin-only functions.
Launch Threat Dragon, choose "Demo" (no login needed) or connect a repo, then create a new, empty model and give it a name like "Online Banking Portal".
Add the actors and components for our sample system: a Customer (actor), the Web App (process), an Auth Service (process), and a Customer DB (store). Connect them with data flows.
Drop a trust boundary between the Customer and the Web App (the internet/DMZ edge), and another around the database tier. Threats almost always cross boundaries.
Walk each element and flow. For every STRIDE category that applies, add a threat in Threat Dragon, set its status (Open / Mitigated / N/A) and describe a mitigation.
Use Threat Dragon's report view to generate the model report. Confirm every Open threat has an owner and a mitigation, then export the JSON to version it alongside your code.
Watch for: Spoofing, Repudiation
Watch for: Tampering, Elevation of Privilege
Watch for: Spoofing, Elevation of Privilege
Watch for: Information Disclosure, Tampering
Watch for: Spoofing, Information Disclosure