Threat Dagon is an open source threat modeling tool and is an official OWASP project. It is used to draw threat modeling diagrams and to list threats for elements in the diagram
OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram along with their remediations.
Threat Dragon is designed to be accessible for various types of teams, with an emphasis on flexibility and simplicity. It is an OWASP Lab Project and follows the values and principles of the threat modeling manifesto
What's Changed
This patch release is primarily intended to address #1627
- Bump baseline-browser-mapping from 2.10.19 to 2.10.20 in the root-npm-version group by @dependabot[bot] in #1608
- Bump actions/setup-node from 6.3.0 to 6.4.0 in /.github/workflows in the update-version group by @dependabot[bot] in #1610
- Skip visual regression tests by @lreading in #1614
- Bump the vue-npm-security group across 1 directory with 3 updates by @dependabot[bot] in #1609
- td.vue: Remove unneeded overrides by @lreading in #1616
- td.server: Remove unneeded overrides by @lreading in #1615
- TM-BOM: refactor and debug merge / import by @jgadsden in #1550
- Bump minimatch from 3.1.3 to 3.1.5 in /td.server in the server-npm-security group across 1 directory by @dependabot[bot] in #1619
- Bump the server-npm-security group across 1 directory with 2 updates by @dependabot[bot] in #1628
- Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 in /.github/workflows in the update-version group by @dependabot[bot] in #1624
- Harden TM-BOM import / merge by @jgadsden in #1626
- Fix inconsistent state between cell data and name for component labels by @lreading in #1630
- add vue key to graph properties to prevent stale cell references by @lreading in #1633
- Release/v2.6.2 by @lreading in #1634
Full Changelog: v2.6.1...v2.6.2
Web application
The web application is provided as a .tar.gz file or a .zip file
along with SBOMs.
Docker containers
The docker images are available from Dockerhub:
- For X86 platforms pull the image: docker pull --platform linux/x86_64 owasp/threat-dragon:v2.6.2
- Alternatively for ARM64 platforms: docker pull --platform linux/arm64 owasp/threat-dragon:v2.6.2-arm64
Desktop version
──────────────────────────────────┬─────────────────────────────────────┬───────────────────────────
Platform │File │SHA512
──────────────────────────────────┼─────────────────────────────────────┼───────────────────────────
Windows NSIS installer │Threat-Dragon-ng-Setup-2.6.2.exe │checksum.yml
──────────────────────────────────┼─────────────────────────────────────┼───────────────────────────
MacOS installer x86 │Threat-Dragon-ng-2.6.2.dmg │checksum-mac.yml
──────────────────────────────────┼─────────────────────────────────────┼───────────────────────────
MacOS installer ARM64 │Threat-Dragon-ng-2.6.2-arm64.dmg │checksum-mac-arm64.yml …
| Publisher | OWASP |
|---|---|
| Author | OWASP contributors |
| Version | 2.6.2 |
| Release date | 2026-05-10 |
| License | Apache-2.0 |
| Installer type | nullsoft |
| Architecture | x64 |
| Package ID | OWASP.ThreatDragon |
winget install --id=OWASP.ThreatDragon -ewinget upgrade --id=OWASP.ThreatDragon -ewinget uninstall --id=OWASP.ThreatDragon -e"Threat-Dragon-ng-Setup-2.6.2.exe" /SYes. Threat-Dragon-ng is free and open-source software released under the Apache-2.0 license.
The latest version is 2.6.2, released on May 10, 2026.
The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with 880d8ab674844d0ef0bd68035985bb1672ae13274e3b7f614452159205b05710.
Threat-Dragon-ng runs on Windows and is available for 64-bit (x64) systems.
Run the offline installer with "Threat-Dragon-ng-Setup-2.6.2.exe" /S, or install it with Windows Package Manager: winget install --id=OWASP.ThreatDragon -e --silent.
Open Settings › Apps › Installed apps, find Threat-Dragon-ng and select Uninstall. From the command line, run winget uninstall --id=OWASP.ThreatDragon -e.
Master your designs with CorelDRAW Graphics Suite
Free, full-featured 3D creation suite
Inkscape is an open-source vector graphics editor similar to Adobe Illustrator, Corel Draw, Freehand, or Xara X. What sets Inkscape apart is its use of Scalable Vector Graphics (SVG), an open XML-based W3C standard, as the native format. In contrast to raster (bitmap) graphics editors such as Photoshop or Gimp, Inkscape stores its graphics in a vector format. Vector graphics is a resolution-independent description of the actual shapes and objects that you see in the image. A rasterization engine uses this information to determine how to plot each line and curve at any resolution or zoom level. Contrast that to bitmap (raster) graphics which is always bound to a specific resolution and stores an image as a grid of pixels. Inkscape can import and display bitmap images, too. An imported bitmap becomes yet another object in your vector graphics, and you can do with it everything you can do to other kinds of objects (move, transform, clip, etc.) While Inkscape does not have all the features of the leading vector editors, the latest versions provide for a large portion of basic vector graphics editing capabilities. People report successfully using Inkscape in a lot of very different projects (web graphics, technical diagrams, icons, creative art, logos, maps).
Solid choice for Creative Cloud vector design
Precision design software for professionals
Effortless image viewing
A simple yet effective tool for basic image editing
Refined editing, smarter photo workflow