Continuous Application Threat Modeling Platform at Scale

Fork is the threat modeling software that empowers your security teams with continuous, data-driven threat assessments using proven PASTA methodology.

by VerSprite

Get started

Risk centric threat modeling under two hours

Identify risks that are most likely to happen and which create the biggest impact. Harnesses our industry-focused threat libraries and integrate real-time vulnerability data and threat intelligence.

A single pane of glass for security insights

Unveil a new perspective on your application's security posture with our unified view. Transform intricate threat data into actionable insights, by merging relevant industry threats with your application's attack surface, and cyber threat intelligence.

Threat modeling from Sprint 1

Harnesses the proven benefits of threat modeling, enabling your teams to identify and integrate security-driven design principles directly into your software from day one.

See All Features

Integrations

Supercharge your threat modeling process by integrating Fork with your existing AppSec tooling.

ServiceNow
ServiceNow
Automatically sync threats and risk metrics to ServiceNow.
Veracode
Veracode
Integrate SCA, SAST, and DAST findings into your threat models.
OpenAI
OpenAI
Powers Fork's AI-assisted threat modeling and DFD generation.
See All Integrations

Leverage the PASTA Methodology

Brought to you by a co-author of the Process for Attack Simulation and Threat Analysis (PASTA) methodology, our platform is a practical implementation of the renowned risk-centric, business-aligned threat modeling framework that raises the bar far beyond traditional approaches.

Stages of PASTA Methodology:

Define Objectives
Define Attack Surface
Decompose Application
Threat Analysis
Weakness and Vulnerability Analysis
Attack Modeling and Simulation
Risk and Impact Analysis
What Is PASTA Threat Modeling?

Simple Pricing, Powerful Security

Get started for free with our threat modeling platform for a single application, or scale up with Fork Enterprise, starting at $75,000/year, to secure your entire organization.

See Full Pricing

Frequently Asked Questions

Answers to common questions about Fork and the PASTA methodology behind it.


What is Fork?
Fork is a continuous application threat modeling platform built on the PASTA methodology. It gives security teams data-driven threat assessments powered by industry-focused threat libraries and real-time vulnerability data, so risk stays visible as your applications evolve.

What is the PASTA methodology?
PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric, business-aligned threat modeling framework, co-authored by a member of Fork's team. It runs through seven stages, from defining objectives to risk and impact analysis, prioritizing threats by business impact rather than technical severity alone.

How long does it take to build a threat model in Fork?
Fork's guided automation walks teams through all seven PASTA stages and produces a first threat model in under two hours. Models don't stop there: Fork resurfaces relevant stages automatically as your application changes.

What's included in Fork Community?
Fork Community is free and covers one application threat model for a single team member, with vulnerability ingestion via SBOM, SARIF, or OVAL. It's built for teams getting started with threat modeling on a single application before scaling further.

What does Fork Enterprise add?
Fork Enterprise unlocks unlimited applications and team members, access to all AI capabilities including the Sous-Chef, documentation analysis, DFD generation, the ability to activate multiple threat libraries at once, access to every integration, granular access controls and permissions, SSO via SAML or OIDC, and full audit logs — built for organizations securing an entire application portfolio.

What tools does Fork integrate with?
Fork connects with ServiceNow, Veracode, GitLab Secure, OpenAI, Tavily, and OpenCTI today, correlating findings and threat intelligence directly into your models. It also maps threat data to MITRE and OWASP standards, including CWE, CVE, CAPEC, ATT&CK, D3FEND, MITRE ATLAS, NIST SP 800-53 (Revision 5), and ASVS.

Can Fork be used throughout the software lifecycle?
Yes. Fork's threat models adapt to your application's current stage, from planning and design through maintenance, so every assessment stays contextually relevant as the application — and the risk landscape around it — continues to evolve.

Is there a service beyond the self-serve platform?
Yes. Threat Modeling as a Service pairs Fork with VerSprite's security champions for portfolio-wide modeling, expert-led training, and human-readable or API-integrated reports, with 1–4 day SLA delivery for teams that want hands-on support.