Automated threat modeling for AppSec teams
Sensei reads a feature design and drafts a STRIDE threat model with attack paths and testable security requirements. Those requirements become findings in DefectDojo Pro, so they get triaged, assigned and tracked like everything else.
What tools automate threat modeling for application security teams?
Threat modeling tools fall into three groups. Open source tools such as OWASP Threat Dragon, OWASP pytm, Threagile and the Microsoft Threat Modeling Tool let you draw or code the model. Commercial platforms such as IriusRisk add workflow around it. AI tools such as AWS Security Agent and DefectDojo Sensei draft the model from design documents. Sensei produces a STRIDE threat model with attack paths and testable security requirements, then pushes those requirements into DefectDojo so they flow through triage, SLAs and Jira.
| Tool | Type | How you build the model | What you get |
|---|---|---|---|
| OWASP Threat Dragon | Open source | Draw data-flow diagrams in a web or desktop app | Diagrams with STRIDE threats |
| OWASP pytm | Open source | Describe the system in Python | Data-flow and sequence diagrams and a threat list |
| Threagile | Open source | Describe the architecture in YAML | Risk report, diagrams and JSON |
| Microsoft Threat Modeling Tool | Free | Draw data-flow diagrams | STRIDE threats per element |
| AWS Threat Composer | Open source | Write structured threat statements | A threat model document |
| IriusRisk | Commercial | Diagrams and questionnaires | Threats and countermeasures pushed to issue trackers |
| AWS Security Agent | AI, in preview | Generated from design documents or code | A STRIDE threat model |
| DefectDojo Sensei | AI, in DefectDojo Pro | Generated from a design document and an optional architecture diagram | STRIDE threats, attack paths, CWE mappings and testable requirements tracked as findings |
What Sensei produces
Architecture with trust boundaries
Sensei extracts the data flows, components and trust boundaries from your design and diagram.
Threats by STRIDE category
Each threat names an attacker profile and an ordered attack path, with a CWE where one applies.
Testable security requirements
Requirements come with verification steps your team can test against.
Coverage gaps, shown
Threats with no mitigating requirement are listed as gaps, not hidden.
Evidence on every item
Each item says where it came from: quoted from the design, read from the diagram, or inferred.
Versioned per asset
Models are versioned on the asset they describe and export as Markdown or JSON.
How it works
Add the design
Paste text or upload a Markdown, text or PDF design document, plus an optional architecture diagram as PNG, JPEG, WebP or GIF.
Review the draft
Sensei returns a draft threat model for your team to review. It is a starting point for the conversation, not a sign-off.
Turn requirements into findings
Push the security requirements into DefectDojo as findings, so they get owners, SLAs and Jira tickets.
Keep it current
Run a new version when the design changes and compare it with the last one.
Already have threat models?
DefectDojo imports threat models from the tools teams already use, so their threats land in the same backlog as scanner findings.
- Threagile
- OWASP Threat Dragon
- AWS Threat Composer
- IriusRisk, by file import or the DefectDojo Pro connector
Read the Sensei threat modeling documentation.
Pricing and next step
Pay as you go
$100/month plus $0.15 per finding processed. No annual commitment. Sensei AI billed per use.
Pre-pay annually
Pre-pay annually and save 48%+. Sensei AI included.
Community Edition
Community Edition, the open source platform that came out of the OWASP community, stays free.
FAQ
What tools automate threat modeling?
Open source tools such as OWASP Threat Dragon, OWASP pytm, Threagile and the Microsoft Threat Modeling Tool help you draw or code a model. IriusRisk is a commercial platform. AI tools such as AWS Security Agent and DefectDojo Sensei draft the model from design documents.
Does Sensei use STRIDE?
Yes. Sensei groups threats by STRIDE category and gives each one an attacker profile, an attack path and a CWE where one applies.
What does Sensei need to build a threat model?
A feature design as pasted text or a Markdown, text or PDF document. An architecture diagram image is optional and improves the result.
Is the generated threat model final?
No. Sensei produces a draft for your team to review. Every item is labelled with its evidence source, and threats without a mitigating requirement are listed as coverage gaps.
Can DefectDojo import threat models from other tools?
Yes. DefectDojo imports from Threagile, OWASP Threat Dragon, AWS Threat Composer and IriusRisk, and DefectDojo Pro also has an IriusRisk connector.
How is Sensei threat modeling priced?
It is part of Sensei in DefectDojo Pro. On Pay As You Go, Sensei is billed per use. Pre-Pay agreements include a Sensei AI allowance listed in your quote.