An Honest Look at Threat Modeling Platforms
Fork, IriusRisk, ThreatModeler, and SD Elements all sell "threat modeling," but they're built on different methodologies, ownership structures, and workflows. Here's how they actually compare.
No spin. Where a competitor does something well, we say so.
In January 2026, ThreatModeler acquired IriusRisk for a reported $100 million-plus, combining what had been the two largest independent threat modeling vendors into a single company. That leaves fewer independent options in a market that now has one dominant, consolidated player.
Fork is built and owned by VerSprite, independent of that combined entity, and built specifically around PASTA rather than as a general-purpose, methodology-agnostic platform. That's the honest starting point for everything below.
Based on each vendor's own published materials as of August 2026. Vendor-reported figures are marked as such — verify current specifics directly with each company, since pricing and features change quickly in this market.
See a live model built on your own application
"PASTA threat modeling tool" is a narrower search than "threat modeling tool" generally, because most platforms on the market weren't built around it. Here's an honest rundown of where PASTA actually shows up in each product today.
PASTA is the entire workflow — all seven stages, end to end — built by a team that includes a co-author of the methodology. There's no "select a methodology" step, because PASTA is the product.
Explicitly lists PASTA as one of several supported methodologies, alongside STRIDE, TRIKE, and OCTAVE, as part of a broader "methodology-agnostic" platform. If your team wants PASTA specifically without other templates in the mix, this is a general-purpose tool adapted to it rather than a PASTA-native one.
Built around STRIDE and its own proprietary VAST methodology. No native PASTA workflow is documented in current product materials.
Takes a requirements-and-questionnaire approach rather than a diagram-and-methodology approach, so PASTA (or STRIDE, for that matter) isn't really the frame it operates in.
Tools like OWASP Threat Dragon or draw.io can be used to sketch a PASTA-style model manually, but they don't provide built-in PASTA automation, stage guidance, or a residual risk calculation.
Read more about the PASTA methodology behind Fork, explore the full feature set, or check pricing for your team's size.
Bring your current tool, your current process, or neither — we'll show you what a PASTA-native model looks like.
30-minute conversation. No commitment required.