THREATGET
THREATGET is a threat modelling and risk management tool for system architectures. Engineers draw a system model, and a maintained threat catalogue automatically flags the applicable threats, attack paths and mitigations for automotive, railway, energy and critical infrastructure projects.
What is THREATGET?
THREATGET is a threat modelling and risk management tool for system design, developed by AIT Austrian Institute of Technology GmbH in Vienna. Its premise is that threat analysis is normally an expensive and subjective expert judgement; THREATGET formalises threat information into machine-readable rules so that the analysis becomes repeatable, updatable and auditable.
The workflow is model-driven. You draw the architecture of the system, with components, wired and wireless connectors, interfaces and ports, assets and trust boundaries, and the tool matches that model against a rule catalogue to return the threats that actually apply. It is a rule engine over a curated threat catalogue, not a generative assistant. Threats are typed with STRIDE; attack trees have given way to directed acyclic graphs to remove duplicated paths, and re-analysis is incremental, so the history of how a risk moved is preserved. Risk is scored as likelihood against impact on a five-by-five matrix, impact is broken down along the SFOP dimensions, and an optional attack feasibility rating follows ISO/SAE 21434. Mitigations and design decisions stay traceable, and the resulting TARA report is downloaded as an xlsx file.
The model library is extensible. Domain catalogues such as ICS and Automotive can be downloaded and customised, users define their own elements, security properties and threats in a dedicated rule language edited in the web interface, published catalogue releases are immutable, and sandbox projects exist for catalogue development. A separate threat intelligence subscription keeps the model library and the threat catalogue current. Team work is supported through projects with Manage, Edit and Read roles, a Cybersecurity Architect role, single sign-on, LDAP and OIDC.
The announced target domains are automotive, railways, energy and critical infrastructure, plus IoT and cyber-physical systems. One caveat about the product's own description: the homepage and the What is THREATGET page still present the tool as an extension of the Enterprise Architect modelling platform, while the version history records that from v24.04 the tool is completely in the web, and the current v2R5 documentation mentions Enterprise Architect only for importing legacy diagrams. The site never reconciles the two accounts. AIT also states that parts of THREATGET were developed in national and international research projects, and that a commercial version is available through ThreatGet 4Biz Consulting GmbH.
What it does
- Model a system architecture: components, wired and wireless connectors, interfaces and ports, assets and trust boundaries.
- Identify the applicable threats automatically by running a rule-based threat catalogue against that model.
- Generate attack paths and attack steps, now as directed acyclic graphs rather than duplicate-prone attack trees.
- Assess risk from likelihood and impact, with impact structured along the SFOP dimensions (safety, financial, operational, privacy).
- Rate attack feasibility according to ISO/SAE 21434 when that optional scoring is enabled.
- Propose mitigations and keep each one traceable back to the threat and forward to the design decision.
- Export the TARA report as an xlsx file for review, audit or certification evidence.
When to use THREATGET / When not to
A quick filter to help you decide if THREATGET is the right fit.
When to use THREATGET
- Engineering teams that must produce a traceable TARA (Threat Analysis and Risk Assessment) and keep it alive across a whole development cycle.
- Automotive manufacturers and suppliers preparing cybersecurity type-approval under UNECE WP.29 and working to ISO/SAE 21434.
- Certification and assessment bodies reviewing vehicle architectures, a group the product folder names explicitly.
- Industrial automation and critical infrastructure teams, who can start from the ICS and Automotive threat catalogues.
- Organisations that require an in-house deployment, because the server runs on their own infrastructure and the system models never leave it.
- University research groups in embedded and automotive cybersecurity: Coventry University, Swansea University, Salzburg University of Applied Sciences and Mykolas Romeris University are named as references.
When not to use THREATGET
- Anyone looking for a code scanner or a penetration-testing tool: THREATGET analyses an architecture model, not a running system.
- Security operations teams that need runtime detection, monitoring or incident response, none of which is in scope.
- Individuals and small teams that want to sign up, pay online and start the same day: there is no public price, no free plan and no self-service trial, only a sales contact and a licence key.
- Teams that need to drive the tool from a CI pipeline or another application, since no product API is documented.
- Organisations without IT support for the rollout: the server needs Linux, Docker and access to a private registry.
- Users expecting a mobile app or a browser extension, neither of which exists.
How to use THREATGET
A typical end-to-end flow, from setup to results.
- Start with the commercial contact: the Partners page names ThreatGet 4Biz Consulting GmbH as the sales contact, and AIT issues the licence key.
- Provision a central Linux server, typically a virtual machine running Ubuntu 20.04 LTS or Debian, with outbound internet access.
- Install Docker and Docker Compose, then authenticate against the private AIT registry (registry.threatget.com) with the credentials AIT supplies.
- Fill in the deployment values: registry user and password, version and licence key from AIT, plus the database and web administrator passwords you choose yourself.
- Put the service behind a TLS terminator and restrict it to the corporate network, using VPN for remote staff; the guide exposes port 80 and leaves HTTPS to you.
- Allow the outbound connection to license.threatget.com for licence verification and element and rule updates, configuring HTTPS_PROXY_HOST and HTTPS_PROXY_PORT with certificate pinning if a proxy sits in the way.
- Set up authentication with single sign-on, LDAP or OIDC, then grant Manage, Edit or Read permissions per project.
- In the browser, create a project, draw the architecture diagram and pick the threat catalogue to run against it.
- Run the analysis and work through the threats, attack graphs, attack steps and applied rules, using the Requires and Provides filters and the adversary capability filter.
- Treat the risks, record mitigations and design decisions, then download the TARA report as xlsx; an administrator tracks licence status, seat count, expiry and update period in the interface.
Pros & Cons
Pros
- Backed by a public research institute: the threat catalogue is maintained inside research projects, and four peer-reviewed publications from 2022 to 2025 (SAFECOMP, IDIMT, MDPI Information, IEEE ICPS) document the approach.
- Explicit alignment with the frameworks that matter in its sectors: ISO/SAE 21434 attack feasibility scoring, IEC 62443, the Cyber Resilience Act and UNECE WP.29 type-approval.
- Genuinely maintained: a dense version history runs from v20.03 to v2R5, with the page last updated on 25/06/2026.
- On-premise deployment keeps system models, often among the most sensitive artefacts an engineering team holds, on the customer's own infrastructure.
- End-to-end traceability from the identified threat through the mitigation to the design decision, with exportable reports.
- Extensible by design: catalogues, elements, security properties and rules can all be defined by the user, with sandbox projects for developing them safely.
- Recognised work and named references: the eAward 2020 in the Industry 4.0 category, first place at the Constantinus Award in the Digitalisation / Internet of Things category, a nomination for the 2022 Austrian Staatspreis, and testimonials from four named universities.
Cons
- No public pricing whatsoever: no pricing page, no amount and no currency symbol anywhere on the site or in the product documentation.
- No free trial and no free plan is announced; the only route in is a sales contact followed by a licence key.
- No documented product API, so the tool cannot be driven programmatically from a toolchain or a CI pipeline.
- Heavy installation: a dedicated Linux server, Docker, access to a private registry, and HTTPS left to the customer, since the deployment guide serves the application over plain HTTP on port 80. Deployment on Windows through Docker is not officially supported.
- The website contradicts itself about the nature of the product: the homepage and the What is THREATGET page still describe an Enterprise Architect extension, although the product has been fully web-based since version 24.04.
- The showcase site is poorly maintained: two Imprint pages coexist, an orphan page survives, no social profile is linked, an award name is misspelled on the homepage, and both announced commercial domains, threatget.eu and cybersecurity.lieberlieber.com, now redirect to threatget.com.
- No DPA, no sub-processor list and no declared hosting country; documentation and interface are English only, the privacy policy is English with a German version on request, and contact enquiries are stored indefinitely.
Pricing & Plans
No price is published. Across the thirteen pages of the website and the whole of the product documentation there is not a single amount or currency symbol, so no free plan and no entry price can be stated here. What is documented is the structure. THREATGET is sold as a software licence, with a licence key issued by AIT and verified online against license.threatget.com. Two licensing models have been supported since v2R4, floating licences and named user licences, and the licence itself carries a number of available seats, an expiry date and an update period, all visible to an administrator inside the interface. A separate threat-database subscription is offered to keep receiving catalogue updates. Neither a free plan nor a self-service trial is announced. The only published route to a quotation is commercial: the Partners page names ThreatGet 4Biz Consulting GmbH as the sales contact, and the privacy policy confirms that THREATGET licence agreements and licensees exist.
Data, GDPR & hosting
A consolidated view of how THREATGET handles your data.
GDPR overview
GDPR implementation is explicit. The policy is written as an Article 13 and Article 14 notice and names AIT Austrian Institute of Technology GmbH as controller, with a designated Data Protection Officer at dpo@ait.ac.at. It lists the rights of access, rectification, erasure, restriction, portability and objection, states that consent may be withdrawn at any time without affecting the lawfulness of earlier processing, and points to the Austrian data protection authority (www.dsb.gv.at) for complaints. Rights are exercised by writing to office@ait.ac.at, and retention periods are given per category of data. Because the controller is established in Austria, no Article 27 representative is required or named. The policy is published in English only, with a German version available on request. No data processing agreement and no sub-processor list are published.
Who owns the data?
The Imprint states plainly that AIT Austrian Institute of Technology GmbH is the owner of the website, and the disclaimer reserves all site content, including copyrights, trademarks and patents, to AIT, permitting only personal and non-commercial use. The same company, at Giefinggasse 4, 1210 Vienna, Austria, is the declared controller for personal data, with a designated Data Protection Officer at dpo@ait.ac.at and a general contact at office@ait.ac.at. For the product itself the picture differs: because the server is installed on the customer's own Linux machine, the system models and analysis results stay on the customer's infrastructure rather than the publisher's. No licence terms covering ownership of customer content are published.
Reuse rights
The privacy policy describes what AIT does with personal data rather than what a reader may do with the site, and the disclaimer answers that second question restrictively: content may be used for personal, non-commercial purposes only, with all rights reserved to AIT. On the personal data side, licensee details (name, company, contact persons, contact details and the scope of the licence) are processed to fulfil THREATGET licence agreements, and the policy states that without this data a licence cannot be obtained. Visitor data, namely IP address, browser, date and time of the visit, and contact enquiries both rest on legitimate interest. THREATGET instances hosted by AIT, mostly for demonstration, additionally record the IP address, Windows computer name, Windows domain name and Windows user name of every person running an analysis. A single recipient is named, YouTube (YouTube, LLC), for embedded videos, and AIT states that it does not determine the purposes of YouTube's processing. Nothing is published about reusing content or analysis output, and the licence agreements themselves are not public.
Data retention & training
Hosting summary
No hosting country or region is declared, for the website or for the instances AIT operates. What the documentation does establish is the deployment model: the THREATGET server is installed and run by the customer, on the customer's own Linux server, so system models and analysis results stay inside the customer's own infrastructure and jurisdiction. That server needs one outbound connection, to license.threatget.com, for licence verification and for element and rule updates. Separately, AIT operates its own THREATGET instances, mostly for demonstration; those record the IP address and the Windows computer, domain and user names of everyone running an analysis, and no location is published for them. The controller for personal data is established in Austria, which places the site's processing inside the European Union, and as a matter of fact the website's server resolves to an address in Vienna. The site itself, however, makes no hosting declaration, so no hosting country is recorded in this listing. No sub-processor list and no data processing agreement are published either.
Things to keep in mind
Risks and trade-offs to weigh before adopting THREATGET.
- The site and the product disagree on what THREATGET is: the marketing pages describe an Enterprise Architect extension, while the version history and the current documentation describe a full web application since v24.04. Confirm what you are actually buying before you commit.
- The company that sells is not the company that publishes the site: ThreatGet 4Biz Consulting GmbH (Handelskai 340, 1020 Vienna) handles sales, while AIT Austrian Institute of Technology GmbH owns the site and the research. Check which entity your contract is with, and who owes you support.
- The commercial web presence has collapsed into a single domain: threatget.eu, still presented on the site as the product and consulting space, redirects to threatget.com, as does cybersecurity.lieberlieber.com. Two Imprint pages with different managing directors also coexist, the one linked in the navigation being the more recent.
- No DPA, no sub-processor list and no declared hosting country are published. If you need any of them, make them a contractual requirement rather than assuming they exist.
- The deployment guide serves the application over plain HTTP on port 80 and leaves TLS termination to you. Rolling it out as-is would expose credentials and threat models across your internal network.
- The server needs a permanent outbound connection to license.threatget.com for licence verification and rule updates, which has to be planned for in an air-gapped or tightly filtered environment.
- An automated threat list is an input to expert judgement, not a replacement for it. The catalogue can only find what its rules describe, the severity counts shown in the product folder are a demonstration example rather than a measured result, and a model that has drifted from the real system will quietly produce a clean and false analysis.
Setup & Integrations
Technical difficulty
High for the installation, low for daily use. Setting up THREATGET is an IT task: a Linux server (Ubuntu 20.04 LTS or Debian, usually a virtual machine), Docker and Docker Compose, authentication against the private AIT registry, and five values to configure: registry user and password, version, licence key, plus database and administrator passwords. Outbound internet access is required. HTTPS is not provided, so a TLS terminator and a certificate fall to the customer, and an outbound proxy can be configured with certificate pinning. The documentation advises involving your IT department. End users then need only a browser.
Deployment
Integrations
Supported languages
Behind THREATGET
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What does THREATGET actually do?
Which domains is it built for?
Is it an Enterprise Architect extension or a web application?
How is it deployed?
What does it cost?
Is there a free trial or a free plan?
Does THREATGET have an API?
Which standards and regulations does it address?
Who publishes the tool, and who sells it?
Do my system models leave my organisation?
Should you pick THREATGET?
THREATGET is a niche tool, but a serious and well documented one. Its value comes from a specific combination: a threat catalogue maintained by a public research institute, an analysis that runs automatically against your own architecture model, and the traceability that sector frameworks such as ISO/SAE 21434, IEC 62443 and UNECE WP.29 type-approval demand. If your team has to produce a defensible TARA and keep it alive across a development cycle, that combination is hard to assemble from generic security tooling.
Two constraints should shape the decision. The first is commercial opacity: no price, no currency and no self-service trial exist in public, so every evaluation begins with a sales conversation, and with ThreatGet 4Biz Consulting GmbH rather than with AIT, which publishes the site. The second is operational: this is a server product. You supply a Linux machine, Docker, outbound access to the licence server and the TLS layer the deployment guide leaves to you. In exchange, your system models stay inside your own infrastructure.
Treat the showcase site as the weakest source in the file. It still describes an Enterprise Architect extension although the product has been fully web-based since v24.04, it carries two Imprint pages and a misspelled award name, and it points to a commercial domain that now redirects back to itself. The version history and the product documentation are current, detailed and far more reliable. Note also what the tool is not: a rule engine over a curated catalogue, not a generative assistant, and not a scanner of running systems.
For automotive, rail, energy and industrial teams with in-house IT support and a compliance obligation, THREATGET deserves a conversation. For anyone hoping to sign up online and start this afternoon, it is the wrong product.
- Choosing a selection results in a full page refresh.
- Opens in a new window.