HomeThreat Modeling Tools and Software ComparisonsPASTA Threat Modeling Tools

PASTA Threat Modeling Tools

How to Operationalize Risk-Centric Threat Modeling

Build a Tailored Engagement or Service Model Today

Reviewed by Tony UcedaVélez, VerSprite CEO and co-author of PASTA

Last updated: August 14, 2026

PASTA threat modeling tools help organizations apply the Process for Attack Simulation and Threat Analysis in a repeatable, collaborative, and maintainable way. The strongest options do more than draw architecture diagrams or generate a list of threats. They help teams connect business objectives, technical scope, application architecture, relevant threat intelligence, weaknesses, viable attack paths, security controls, and residual business risk.

PASTA is a methodology, not a software product. A platform can be built specifically around PASTA, while other tools may support individual artifacts or stages without implementing the complete seven-stage process.

This guide explains what to look for in PASTA threat modeling software, how different tool categories can support the methodology, and when an expert-led service may be more appropriate than software alone.

What Is PASTA Threat Modeling?

PASTA stands for Process for Attack Simulation and Threat Analysis. It is a seven-stage, risk-centric threat modeling methodology that aligns technical security analysis with business objectives and business impact.

Rather than stopping at broad threat categories, PASTA helps teams determine which adversaries, attack patterns, weaknesses, and attack paths are relevant to a specific application or system. The resulting model supports evidence-based prioritization of countermeasures and residual risk.


PASTA stage	Primary outcome
1. Define Objectives	Establish business objectives, security requirements, compliance obligations, application criticality, and potential business impact.
2. Define Technical Scope	Identify the technologies, services, infrastructure, data, dependencies, and attack surface included in the analysis.
3. Application Decomposition	Map components, data flows, trust boundaries, users, identities, entry points, dependencies, and security controls.
4. Threat Analysis	Identify relevant threat actors, motivations, capabilities, attack patterns, and intelligence that apply to the environment.
5. Vulnerability and Weakness Analysis	Identify design weaknesses, implementation vulnerabilities, control gaps, and conditions that could enable relevant threats.
6. Attack Modeling	Construct realistic attack scenarios that connect adversary objectives with the architecture, weaknesses, and existing controls.
7. Risk and Impact Analysis	Evaluate inherent and residual risk, business and technical impact, control effectiveness, and prioritized countermeasures.

What Makes a Tool PASTA-Capable?

A PASTA-capable tool should support the complete reasoning process, not simply attach the PASTA label to a diagram or threat list. Buyers should test whether the platform can preserve context and evidence across all seven stages.

Capture business objectives, application criticality, regulatory obligations, and impact criteria.
Maintain a defined technical scope and inventory of in-scope technologies, services, dependencies, and data.
Represent application components, trust boundaries, users, identities, data flows, entry points, and controls.
Incorporate relevant threat actors, attack patterns, and threat intelligence.
Correlate weaknesses and vulnerabilities with the architecture and identified threats.
Model realistic attack sequences, attacker objectives, prerequisites, and control interactions.
Calculate or document inherent risk, control effectiveness, residual risk, and business impact.
Preserve traceability from a risk decision back to the supporting evidence.
Update the model when architecture, vulnerabilities, controls, threats, or business priorities change.
Support collaboration among security, engineering, product, architecture, risk, and business stakeholders.

PASTA Threat Modeling Options at a Glance

Fork

Type: PASTA-native commercial platform

How it supports PASTA: Operationalizes the seven stages within a continuous application threat modeling workflow

Best suited for: Organizations seeking repeatable, business-aligned PASTA models across applications

VerSprite Threat Modeling as a Service (TMaaS)

Type: Expert-led PASTA delivery

How it supports PASTA: Applies the methodology through facilitated analysis, adversarial validation, and risk prioritization

Best suited for: Organizations that need specialist expertise, independent validation, or program development

OWASP Threat Dragon

Type: Open-source diagramming and threat-recording tool

How it supports PASTA: Can support architecture decomposition and documentation of threats and mitigations

Best suited for: Teams assembling a custom PASTA workflow with internal expertise

Microsoft Threat Modeling Tool

Type: Free design-stage threat modeling tool

How it supports PASTA: Can support architecture analysis and structured threat identification, especially in Microsoft SDL workflows

Best suited for: Teams using it as one input within a broader PASTA process

Threagile or OWASP pytm

Type: Free design-stage threat modeling tool

How it supports PASTA: Can support version-controlled architecture, threats, assumptions, and automation

Best suited for: Engineering-led teams building custom PASTA artifacts and integrations

Security and risk toolchain

Type: Supporting systems

How it supports PASTA: Threat intelligence, vulnerability data, testing results, ticketing, controls, and risk records can inform multiple PASTA stages

Best suited for: Mature programs integrating PASTA into existing AppSec and risk operations

Fork: A Platform Built Around PASTA

Fork is a continuous application threat modeling platform built around PASTA. It is designed to help security, product, engineering, architecture, and business stakeholders maintain a shared view of application risk as software evolves.

The platform is positioned around the complete risk-centric process rather than a single architecture diagram or one-time workshop. Organizations evaluating Fork should assess how it supports business context, technical scope, application decomposition, threat and weakness analysis, attack modeling, controls, and residual risk across their application portfolio.

A workflow structured around PASTA and risk-centric analysis.
Application context that connects technical findings to business purpose and impact.
Collaboration across security, product, engineering, architecture, and business stakeholders.
Correlation of threats, weaknesses, vulnerabilities, controls, and attack scenarios.
Continuous model maintenance as applications and security conditions change.
Risk prioritization that is intended to be explainable to both technical and business audiences.

Can Other Threat Modeling Tools Support PASTA?

Yes. A tool does not need to be PASTA-native to support part of the methodology. Architecture tools, diagramming applications, threat libraries, vulnerability platforms, attack-mapping systems, risk registers, and ticketing platforms can all contribute useful evidence or workflow support.

The important distinction is between supporting a stage and implementing the methodology. A diagramming tool may help with application decomposition. A vulnerability platform may inform weakness analysis. An attack framework may help structure attack scenarios. A GRC platform may record risk treatment. None of those capabilities, by itself, demonstrates that the complete PASTA process is being performed.

OWASP Threat Dragon in a PASTA Workflow

OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application that supports data-flow diagrams, threat recording, mitigations, and multiple threat categorization approaches. It can be useful during application decomposition and for documenting threats and remediations.

Teams using Threat Dragon with PASTA would still need a defined process for business objectives, threat intelligence, vulnerability correlation, attack modeling, risk analysis, business impact, and residual-risk decisions.

Microsoft Threat Modeling Tool in a PASTA Workflow

The Microsoft Threat Modeling Tool supports design-stage security analysis, architecture communication, threat identification, mitigations, and reporting within Microsoft SDL workflows. It can provide useful architecture and threat-analysis inputs.

A PASTA implementation would need to extend beyond those outputs to incorporate business context, relevant adversary intelligence, weakness correlation, realistic attack modeling, and business-impact-based risk prioritization.

Threat Modeling as Code in a PASTA Workflow

Tools such as Threagile and OWASP pytm can help engineering teams describe systems, assumptions, threats, and controls in version-controlled formats. This can make selected PASTA artifacts easier to review, automate, and update through software delivery workflows.

The organization must still define how business objectives, attacker context, evidence, attack viability, impact, and residual risk are represented. Threat modeling as code is an operating format, not a substitute for the methodology.