{"product_id":"threatget","title":"THREATGET","description":"\u003cstyle\u003e\n.guidaio-v3 { --gv3-bg:#f6f5fb;--gv3-surface:#fff;--gv3-surface-soft:#fbfaff;--gv3-ink:#14132b;--gv3-ink-2:#2b2a4a;--gv3-muted:#6c6a8a;--gv3-line:#ecebf5;--gv3-line-2:#e0deef;--gv3-brand:#5b3df5;--gv3-brand-2:#7c63ff;--gv3-brand-soft:#efeaff;--gv3-brand-ink:#2c1d8a;--gv3-ok:#0f8a5a;--gv3-ok-soft:#e6f7ee;--gv3-warn:#b16800;--gv3-warn-soft:#fff3dc;--gv3-bad:#b3261e;--gv3-bad-soft:#fde7e6;--gv3-radius-lg:22px;--gv3-radius:16px;--gv3-radius-sm:10px;--gv3-shadow-sm:0 1px 2px rgba(20,19,43,.04);--gv3-shadow:0 12px 30px rgba(53,38,124,.07);\n  background:radial-gradient(1200px 600px at 80% -10%,rgba(124,99,255,.18),transparent 60%),radial-gradient(900px 500px at -10% 5%,rgba(91,61,245,.12),transparent 60%),var(--gv3-bg);\n  color:var(--gv3-ink);font-family:Inter,system-ui,-apple-system,\"Segoe UI\",Roboto,sans-serif;font-size:16px;line-height:1.6;-webkit-font-smoothing:antialiased;\n  max-width:1240px;margin:0 auto;padding:24px 16px 64px;border-radius:var(--gv3-radius-lg);}\n.guidaio-v3 *,.guidaio-v3 *::before,.guidaio-v3 *::after{box-sizing:border-box}\n.guidaio-v3 a{color:var(--gv3-brand);text-decoration:none}.guidaio-v3 a:hover{text-decoration:underline}\n.guidaio-v3 img{max-width:100%;display:block}\n.guidaio-v3 h1,.guidaio-v3 h2,.guidaio-v3 h3,.guidaio-v3 h4{font-family:\"Space Grotesk\",Inter,sans-serif;letter-spacing:-.01em;margin:0;color:var(--gv3-ink)}\n.guidaio-v3 svg{display:inline-block;vertical-align:middle}\n.guidaio-v3 .hero{position:relative;background:radial-gradient(700px 320px at 90% 0%,rgba(124,99,255,.18),transparent 70%),linear-gradient(180deg,#fff 0%,#fbfaff 100%);border:1px solid var(--gv3-line);border-radius:var(--gv3-radius-lg);box-shadow:var(--gv3-shadow);padding:32px;overflow:hidden}\n.guidaio-v3 .hero-grid{display:grid;grid-template-columns:minmax(0,1.5fr) minmax(280px,1fr);gap:28px;align-items:start}\n.guidaio-v3 .hero-head{display:flex;gap:16px;align-items:flex-start}\n.guidaio-v3 .logo-tile{width:72px;height:72px;border-radius:18px;border:1px solid var(--gv3-line-2);background:#fff;box-shadow:var(--gv3-shadow-sm);display:grid;place-items:center;overflow:hidden;flex:0 0 auto}\n.guidaio-v3 .logo-tile img{width:56px;height:56px;object-fit:contain}\n.guidaio-v3 .eyebrow{display:inline-flex;align-items:center;gap:6px;color:var(--gv3-brand-ink);background:var(--gv3-brand-soft);padding:6px 12px;border-radius:999px;font-size:12px;font-weight:700;letter-spacing:.04em;text-transform:uppercase}\n.guidaio-v3 h1.title{margin-top:12px;font-size:34px;line-height:1.1;color:var(--gv3-ink)}\n.guidaio-v3 .lede{margin:14px 0 0;font-size:17px;color:var(--gv3-ink-2);max-width:60ch}\n.guidaio-v3 .badge-row,.guidaio-v3 .chip-row{display:flex;flex-wrap:wrap;gap:8px;margin-top:16px}\n.guidaio-v3 .badge{display:inline-flex;align-items:center;gap:6px;padding:6px 11px;border-radius:999px;font-size:12px;font-weight:600;background:#fff;border:1px solid var(--gv3-line-2);color:var(--gv3-ink-2)}\n.guidaio-v3 .badge.ok{background:var(--gv3-ok-soft);color:var(--gv3-ok);border-color:#b8e8cc}\n.guidaio-v3 .badge.warn{background:var(--gv3-warn-soft);color:var(--gv3-warn);border-color:#f1d6a3}\n.guidaio-v3 .badge.bad{background:var(--gv3-bad-soft);color:var(--gv3-bad);border-color:#f5c2c0}\n.guidaio-v3 .badge.brand{background:var(--gv3-brand-soft);color:var(--gv3-brand-ink);border-color:#d6cdfb}\n.guidaio-v3 .tbd-row{margin-top:14px;display:grid;gap:10px}\n.guidaio-v3 .tbd-row .label{font-size:11px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--gv3-muted)}\n.guidaio-v3 .chip{display:inline-flex;align-items:center;gap:6px;padding:5px 11px;border-radius:999px;font-size:13px;border:1px solid var(--gv3-line-2);background:#fff;color:var(--gv3-ink-2)}\n.guidaio-v3 .chip.cat{background:#eef2ff;color:#3730a3;border-color:#c7d2fe}\n.guidaio-v3 .chip.dom{background:#ecfeff;color:#0e7490;border-color:#a5f3fc}\n.guidaio-v3 .chip.prof{background:#fdf4ff;color:#86198f;border-color:#f5d0fe}\n.guidaio-v3 .cta-row{display:flex;gap:10px;flex-wrap:wrap;margin-top:22px}\n.guidaio-v3 .btn{display:inline-flex;align-items:center;gap:8px;padding:11px 16px;border-radius:12px;font-weight:700;border:1px solid transparent;cursor:pointer;font-size:14px}\n.guidaio-v3 .btn:hover{text-decoration:none}\n.guidaio-v3 .btn-primary{background:linear-gradient(135deg,var(--gv3-brand) 0%,var(--gv3-brand-2) 100%);color:#fff;box-shadow:0 14px 28px rgba(91,61,245,.28)}\n.guidaio-v3 .btn-secondary{background:#fff;color:var(--gv3-brand-ink);border-color:#d6cdfb}\n.guidaio-v3 .btn-ghost{background:transparent;color:var(--gv3-ink-2);border-color:var(--gv3-line-2)}\n.guidaio-v3 .affiliate-note{margin-top:10px;font-size:12px;color:var(--gv3-muted)}\n.guidaio-v3 .snapshot{background:#fff;border:1px solid var(--gv3-line);border-radius:var(--gv3-radius-lg);padding:20px;box-shadow:var(--gv3-shadow)}\n.guidaio-v3 .snapshot h3{font-size:13px;text-transform:uppercase;letter-spacing:.08em;color:var(--gv3-brand-ink);margin-bottom:14px}\n.guidaio-v3 .snapshot dl{margin:0;display:grid;grid-template-columns:1fr;gap:12px}\n.guidaio-v3 .snapshot .row{display:grid;grid-template-columns:1fr auto;gap:8px;padding-bottom:12px;border-bottom:1px dashed var(--gv3-line-2)}\n.guidaio-v3 .snapshot .row:last-child{border-bottom:0;padding-bottom:0}\n.guidaio-v3 .snapshot dt{color:var(--gv3-muted);font-size:13px;margin:0}\n.guidaio-v3 .snapshot dd{margin:0;text-align:right;font-weight:700;color:var(--gv3-ink);font-size:13px}\n.guidaio-v3 .snapshot dd small{display:block;font-weight:500;color:var(--gv3-muted);font-size:11px;text-align:right}\n.guidaio-v3 .price-big{font-family:\"Space Grotesk\";font-size:20px;line-height:1}\n.guidaio-v3 .toc{margin:20px 0 24px;padding:10px;background:rgba(255,255,255,.85);border:1px solid var(--gv3-line);border-radius:22px;box-shadow:var(--gv3-shadow-sm);display:flex;flex-wrap:wrap;gap:8px;overflow-x:auto}\n.guidaio-v3 .toc a{padding:8px 14px;border-radius:999px;font-size:13px;font-weight:600;color:var(--gv3-brand-ink);background:#fff;white-space:nowrap;border:1px solid var(--gv3-line-2);box-shadow:var(--gv3-shadow-sm);transition:transform .18s ease,box-shadow .18s ease,background .18s ease,color .18s ease,border-color .18s ease}\n.guidaio-v3 .toc a:hover{background:linear-gradient(135deg,var(--gv3-brand) 0%,var(--gv3-brand-2) 100%);color:#fff;border-color:transparent;transform:translateY(-2px) scale(1.04);box-shadow:0 8px 18px rgba(91,61,245,.25);text-decoration:none}\n.guidaio-v3 .justify{text-align:justify;text-justify:inter-word;hyphens:auto}\n.guidaio-v3 a.chip,.guidaio-v3 a.chip:hover{text-decoration:none}\n.guidaio-v3 a.chip{transition:transform .15s ease,box-shadow .15s ease,filter .15s ease;cursor:pointer}\n.guidaio-v3 a.chip:hover{transform:translateY(-1px);box-shadow:0 4px 10px rgba(53,38,124,.12);filter:brightness(.96)}\n.guidaio-v3 section.block{background:var(--gv3-surface);border:1px solid var(--gv3-line);border-radius:var(--gv3-radius-lg);padding:32px;margin-top:22px;box-shadow:var(--gv3-shadow-sm);scroll-margin-top:90px}\n.guidaio-v3 section.block.soft{background:var(--gv3-surface-soft)}\n.guidaio-v3 section.block .head{margin-bottom:20px}\n.guidaio-v3 section.block .eyebrow + h2{margin-top:10px}\n.guidaio-v3 section.block h2{font-size:24px;color:var(--gv3-ink)}\n.guidaio-v3 section.block .lead{margin-top:8px;color:var(--gv3-muted);max-width:70ch}\n.guidaio-v3 .grid-2{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:16px}\n.guidaio-v3 .grid-3{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:14px}\n.guidaio-v3 .rich p{margin:0 0 14px}.guidaio-v3 .rich p:last-child{margin:0}\n.guidaio-v3 ul.brand-list{list-style:none;padding:0;margin:0;display:grid;gap:10px}\n.guidaio-v3 ul.brand-list li{position:relative;padding-left:26px;color:var(--gv3-ink-2)}\n.guidaio-v3 ul.brand-list li::before{content:\"\";position:absolute;left:0;top:9px;width:14px;height:14px;border-radius:999px;background:var(--gv3-brand-soft);box-shadow:inset 0 0 0 4px var(--gv3-brand)}\n.guidaio-v3 ol.steps{list-style:none;counter-reset:s;padding:0;margin:0;display:grid;gap:14px}\n.guidaio-v3 ol.steps li{counter-increment:s;position:relative;padding-left:42px;color:var(--gv3-ink-2);min-height:30px}\n.guidaio-v3 ol.steps li::before{content:counter(s);position:absolute;left:0;top:0;width:30px;height:30px;border-radius:999px;background:linear-gradient(135deg,var(--gv3-brand) 0%,var(--gv3-brand-2) 100%);color:#fff;display:grid;place-items:center;font-weight:700;font-size:13px;box-shadow:0 6px 14px rgba(91,61,245,.25)}\n.guidaio-v3 .feature-card{border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);padding:16px;background:#fff;display:grid;gap:8px}\n.guidaio-v3 .feature-card .icbox{width:36px;height:36px;border-radius:12px;background:var(--gv3-brand-soft);color:var(--gv3-brand-ink);display:grid;place-items:center}\n.guidaio-v3 .feature-card .ftitle{font-weight:700;color:var(--gv3-ink);font-size:15px}\n.guidaio-v3 .feature-card .fbody{color:var(--gv3-muted);font-size:13px}\n.guidaio-v3 .pc{border-radius:var(--gv3-radius);padding:20px;border:1px solid var(--gv3-line)}\n.guidaio-v3 .pc.pros{background:var(--gv3-ok-soft);border-color:#b8e8cc}\n.guidaio-v3 .pc.cons{background:var(--gv3-bad-soft);border-color:#f5c2c0}\n.guidaio-v3 .pc h3{font-size:17px;display:flex;align-items:center;gap:8px;margin-bottom:12px}\n.guidaio-v3 .pc.pros h3{color:var(--gv3-ok)}.guidaio-v3 .pc.cons h3{color:var(--gv3-bad)}\n.guidaio-v3 .pc ul{list-style:none;padding:0;margin:0;display:grid;gap:8px}\n.guidaio-v3 .pc li{display:flex;gap:8px;align-items:flex-start;color:var(--gv3-ink-2);font-size:14px}\n.guidaio-v3 .pc li svg{flex:0 0 auto;margin-top:3px}\n.guidaio-v3 .pc.pros li svg{color:var(--gv3-ok)}.guidaio-v3 .pc.cons li svg{color:var(--gv3-bad)}\n.guidaio-v3 .bestnot{display:grid;grid-template-columns:1fr 1fr;gap:16px}\n.guidaio-v3 .bestnot .card{border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);padding:20px;background:#fff}\n.guidaio-v3 .bestnot h3{display:flex;align-items:center;gap:8px;font-size:17px;margin-bottom:12px}\n.guidaio-v3 .bestnot .for h3{color:var(--gv3-ok)}.guidaio-v3 .bestnot .not h3{color:var(--gv3-warn)}\n.guidaio-v3 .plan-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:14px}\n.guidaio-v3 .plan{border:1px solid var(--gv3-line);border-radius:var(--gv3-radius-lg);padding:22px;background:#fff;display:grid;gap:10px;position:relative}\n.guidaio-v3 .plan.featured{border-color:#c7baff;background:linear-gradient(180deg,#fff 0%,#f7f3ff 100%);box-shadow:var(--gv3-shadow)}\n.guidaio-v3 .plan .pill{position:absolute;top:-12px;right:14px;background:linear-gradient(135deg,var(--gv3-brand) 0%,var(--gv3-brand-2) 100%);color:#fff;font-size:11px;font-weight:700;letter-spacing:.06em;padding:5px 9px;border-radius:999px;text-transform:uppercase}\n.guidaio-v3 .plan .pname{font-family:\"Space Grotesk\";font-weight:700;font-size:17px}\n.guidaio-v3 .plan .pprice{font-family:\"Space Grotesk\";font-size:24px;font-weight:700}\n.guidaio-v3 .plan .pprice small{font-size:13px;font-weight:500;color:var(--gv3-muted)}\n.guidaio-v3 .plan ul{list-style:none;padding:0;margin:6px 0 0;display:grid;gap:8px}\n.guidaio-v3 .plan ul li{display:flex;gap:8px;align-items:flex-start;color:var(--gv3-ink-2);font-size:14px}\n.guidaio-v3 .plan ul li svg{color:var(--gv3-brand);flex:0 0 auto;margin-top:3px}\n.guidaio-v3 .pricing-extras{margin-top:16px;display:grid;gap:10px}\n.guidaio-v3 .offer{display:flex;gap:10px;align-items:flex-start;padding:12px 14px;border-radius:12px;background:#fff7e6;border:1px solid #f1d6a3;color:var(--gv3-warn);font-size:14px}\n.guidaio-v3 .offer svg{flex:0 0 auto;margin-top:2px}\n.guidaio-v3 .trust-grid{display:grid;grid-template-columns:2fr 1fr;gap:16px}\n.guidaio-v3 .trust-grid .col{display:grid;gap:14px}\n.guidaio-v3 .trust-card{background:#fff;border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);padding:20px}\n.guidaio-v3 .trust-card h3{font-size:15px;margin-bottom:10px}\n.guidaio-v3 .kv{display:grid;grid-template-columns:180px 1fr;gap:12px;padding:10px 0;border-top:1px solid var(--gv3-line)}\n.guidaio-v3 .kv:first-child{border-top:0;padding-top:0}\n.guidaio-v3 .kv .k{color:var(--gv3-muted);font-size:13px}\n.guidaio-v3 .kv .v{color:var(--gv3-ink);font-size:14px}\n.guidaio-v3 .availability{display:grid;grid-template-columns:1fr 1fr;gap:16px}\n.guidaio-v3 .availability .card{border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);background:#fff;padding:18px}\n.guidaio-v3 .flag-row{display:flex;flex-wrap:wrap;gap:8px}\n.guidaio-v3 .flag{display:inline-flex;align-items:center;gap:5px;padding:5px 10px;border-radius:999px;background:#fff;border:1px solid var(--gv3-line-2);font-size:13px;color:var(--gv3-ink-2)}\n.guidaio-v3 section.block.watch{background:#fffaf0;border:1px solid #f1d6a3}\n.guidaio-v3 section.block.watch .head h2{color:var(--gv3-warn)}\n.guidaio-v3 .setup-grid{display:grid;grid-template-columns:1fr 1fr;gap:16px}\n.guidaio-v3 .setup-card{background:#fff;border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);padding:20px}\n.guidaio-v3 .integrations{display:flex;flex-wrap:wrap;gap:8px}\n.guidaio-v3 .integration{display:inline-flex;align-items:center;gap:6px;padding:7px 11px;border-radius:12px;background:#fff;border:1px solid var(--gv3-line-2);color:var(--gv3-ink-2);font-size:13px;font-weight:600}\n.guidaio-v3 .company-grid{display:grid;grid-template-columns:1.4fr 1fr;gap:16px}\n.guidaio-v3 .company-card{border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);background:#fff;padding:20px}\n.guidaio-v3 .timeline{display:grid;gap:8px;margin:8px 0 0}\n.guidaio-v3 .timeline .ev{padding:10px 14px;border-radius:12px;background:var(--gv3-brand-soft);color:var(--gv3-brand-ink);font-weight:600;font-size:14px;display:flex;align-items:center;gap:8px}\n.guidaio-v3 .social-row{display:flex;gap:8px;flex-wrap:wrap}\n.guidaio-v3 .social{width:36px;height:36px;border-radius:12px;border:1px solid var(--gv3-line-2);background:#fff;display:grid;place-items:center;color:var(--gv3-ink-2)}\n.guidaio-v3 .social:hover{background:var(--gv3-brand-soft);color:var(--gv3-brand-ink);border-color:#d6cdfb}\n.guidaio-v3 .res-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}\n.guidaio-v3 .res{display:flex;gap:10px;align-items:center;padding:10px 12px;border-radius:12px;border:1px solid var(--gv3-line);background:#fff;color:var(--gv3-ink-2);font-size:13px}\n.guidaio-v3 .res:hover{border-color:#d6cdfb;background:#fbfaff;text-decoration:none}\n.guidaio-v3 .res svg{color:var(--gv3-brand);flex:0 0 auto}\n.guidaio-v3 .res .url{color:var(--gv3-muted);font-size:11px;word-break:break-all}\n.guidaio-v3 .res .res-text{display:grid}\n.guidaio-v3 .alts{display:flex;flex-wrap:wrap;gap:8px}\n.guidaio-v3 .alt{display:inline-flex;align-items:center;gap:8px;padding:9px 13px;border-radius:14px;background:#fff;border:1px solid var(--gv3-line-2);font-weight:600;color:var(--gv3-ink-2);font-size:14px}\n.guidaio-v3 .alt .av{width:24px;height:24px;border-radius:8px;background:linear-gradient(135deg,#c7baff 0%,#efeaff 100%);display:grid;place-items:center;font-size:12px;font-weight:700;color:var(--gv3-brand-ink)}\n.guidaio-v3 .faq{display:grid;gap:10px}\n.guidaio-v3 .faq details{background:#fff;border:1px solid var(--gv3-line);border-radius:var(--gv3-radius);padding:14px 16px}\n.guidaio-v3 .faq summary{cursor:pointer;list-style:none;font-weight:700;color:var(--gv3-ink);display:flex;justify-content:space-between;align-items:center;gap:10px;font-size:15px}\n.guidaio-v3 .faq summary::-webkit-details-marker{display:none}\n.guidaio-v3 .faq summary svg{color:var(--gv3-brand)}\n.guidaio-v3 .faq .ans{color:var(--gv3-muted);margin-top:10px;font-size:14px}\n.guidaio-v3 section.block.conclusion{background:radial-gradient(700px 320px at 0% 0%,rgba(124,99,255,.18),transparent 60%),linear-gradient(135deg,#1c163a 0%,#2c1d8a 100%);color:#fff;border-color:#2c1d8a}\n.guidaio-v3 section.block.conclusion .head h2{color:#fff}\n.guidaio-v3 section.block.conclusion .lead,.guidaio-v3 section.block.conclusion .rich p{color:rgba(255,255,255,.88)}\n.guidaio-v3 section.block.conclusion .rich strong,.guidaio-v3 section.block.conclusion .rich b{color:#fff}\n.guidaio-v3 section.block.conclusion .eyebrow{background:rgba(255,255,255,.14);color:#fff}\n.guidaio-v3 section.block.conclusion .btn-secondary{background:rgba(255,255,255,.14);color:#fff;border-color:rgba(255,255,255,.25)}\n@media (max-width:1080px){.guidaio-v3 .hero-grid,.guidaio-v3 .trust-grid,.guidaio-v3 .company-grid,.guidaio-v3 .setup-grid,.guidaio-v3 .availability{grid-template-columns:1fr}.guidaio-v3 .grid-3,.guidaio-v3 .res-grid,.guidaio-v3 .plan-grid{grid-template-columns:repeat(2,minmax(0,1fr))}}\n@media (max-width:700px){.guidaio-v3{padding:12px 8px 48px}.guidaio-v3 .hero{padding:20px}.guidaio-v3 section.block{padding:20px}.guidaio-v3 .grid-2,.guidaio-v3 .grid-3,.guidaio-v3 .res-grid,.guidaio-v3 .plan-grid,.guidaio-v3 .bestnot,.guidaio-v3 .availability{grid-template-columns:1fr}.guidaio-v3 h1.title{font-size:28px}}\n\u003c\/style\u003e\n\u003cdiv class=\"guidaio-v3\" itemscope itemtype=\"https:\/\/schema.org\/SoftwareApplication\"\u003e\n\u003cmeta itemprop=\"name\" content=\"THREATGET - Threat Modelling and Risk Analysis Tool by AIT\"\u003e\n\u003cmeta itemprop=\"description\" content=\"THREATGET: threat modelling and risk analysis for automotive, rail, energy and IoT architectures. Automatic threat detection, attack paths and TARA reports.\"\u003e\n\u003cdiv class=\"hero\"\u003e\u003cdiv class=\"hero-grid\"\u003e\n\u003cdiv\u003e\n\u003cdiv class=\"hero-head\"\u003e\n\u003cdiv class=\"logo-tile\"\u003e\u003cimg src=\"https:\/\/www.threatget.com\/wp-content\/uploads\/2019\/06\/cropped-Threat-Get-Square-512-1-1.png\" alt=\"THREATGET logo\" itemprop=\"image\" loading=\"lazy\"\u003e\u003c\/div\u003e\n\u003cdiv class=\"name-block\"\u003e\n\u003cspan class=\"eyebrow\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"m12 3-1.9 5.8a2 2 0 0 1-1.3 1.3L3 12l5.8 1.9a2 2 0 0 1 1.3 1.3L12 21l1.9-5.8a2 2 0 0 1 1.3-1.3L21 12l-5.8-1.9a2 2 0 0 1-1.3-1.3Z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Privacy Security · Report Generation\u003c\/span\u003e\u003ch1 class=\"title\" itemprop=\"name\"\u003eTHREATGET\u003c\/h1\u003e\n\u003cp class=\"lede justify\" itemprop=\"description\"\u003eTHREATGET is a threat modelling and risk management tool for system architectures. Engineers draw a system model, and a maintained threat catalogue automatically flags the applicable threats, attack paths and mitigations for automotive, railway, energy and critical infrastructure projects.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"badge-row\"\u003e\n\u003cspan class=\"badge ok\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003ccircle cx=\"12\" cy=\"12\" r=\"10\"\u003e\u003c\/circle\u003e\u003cpath d=\"m9 12 2 2 4-4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Active\u003c\/span\u003e\u003cspan class=\"badge ok\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z\"\u003e\u003c\/path\u003e\u003cpath d=\"m9 12 2 2 4-4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e GDPR compliant\u003c\/span\u003e\u003cspan class=\"badge\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"22 7 13.5 15.5 8.5 10.5 2 17\"\u003e\u003c\/polyline\u003e\u003cpolyline points=\"16 7 22 7 22 13\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e Contact Sales\u003c\/span\u003e\u003cspan class=\"badge\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"M6.3 20.3a2.4 2.4 0 0 0 3.4 0L12 18l-6-6-2.3 2.3a2.4 2.4 0 0 0 0 3.4Z\"\u003e\u003c\/path\u003e\u003cpath d=\"m2 22 3-3\"\u003e\u003c\/path\u003e\u003cpath d=\"M7.5 13.5 10 11\"\u003e\u003c\/path\u003e\u003cpath d=\"M10.5 16.5 13 14\"\u003e\u003c\/path\u003e\u003cpath d=\"m18 3-4 4h6l-4 4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e No public API\u003c\/span\u003e\u003cspan class=\"badge brand\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003ccircle cx=\"12\" cy=\"12\" r=\"10\"\u003e\u003c\/circle\u003e\u003cpath d=\"m9 12 2 2 4-4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Verified by Guidaio\u003c\/span\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"tbd-row\"\u003e\n\u003cdiv\u003e\n\u003cdiv class=\"label\"\u003eCategories\u003c\/div\u003e\n\u003cdiv class=\"chip-row\"\u003e\n\u003ca class=\"chip cat\" href=\"\/collections\/privacy-security\"\u003ePrivacy Security\u003c\/a\u003e\u003ca class=\"chip cat\" href=\"\/collections\/report-generation\"\u003eReport Generation\u003c\/a\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv\u003e\n\u003cdiv class=\"label\"\u003eTarget domains\u003c\/div\u003e\n\u003cdiv class=\"chip-row\"\u003e\n\u003ca class=\"chip dom\" href=\"\/collections\/cybersecurity\"\u003eCybersecurity\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/automotive-mobility\"\u003eAutomotive Mobility\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/transportation\"\u003eTransportation\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/energy-utilities\"\u003eEnergy Utilities\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/mechanical-manufacturing\"\u003eMechanical Manufacturing\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/electrical-electronics\"\u003eElectrical Electronics\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/it-software\"\u003eIt Software\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/quality-regulatory\"\u003eQuality Regulatory\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/science-r-d\"\u003eScience R D\u003c\/a\u003e\u003ca class=\"chip dom\" href=\"\/collections\/education-academia\"\u003eEducation Academia\u003c\/a\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"cta-row\"\u003e\u003ca class=\"btn btn-primary\" href=\"https:\/\/www.threatget.com\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"16\" height=\"16\"\u003e\u003cpath d=\"M15 3h6v6\"\u003e\u003c\/path\u003e\u003cpath d=\"M10 14 21 3\"\u003e\u003c\/path\u003e\u003cpath d=\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Discover THREATGET\u003c\/a\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003caside class=\"snapshot\"\u003e\u003ch3\u003eSnapshot\u003c\/h3\u003e\n\u003cdl\u003e\n\u003cdiv class=\"row\"\u003e\n\u003cdt\u003ePricing model\u003c\/dt\u003e\n\u003cdd\u003eContact Sales\u003c\/dd\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"row\"\u003e\n\u003cdt\u003eAPI available\u003c\/dt\u003e\n\u003cdd\u003eNo\u003c\/dd\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"row\"\u003e\n\u003cdt\u003eDeployment\u003c\/dt\u003e\n\u003cdd\u003eWeb app\u003c\/dd\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"row\"\u003e\n\u003cdt\u003eLanguages\u003c\/dt\u003e\n\u003cdd\u003eEnglish\u003c\/dd\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"row\"\u003e\n\u003cdt\u003eTool status\u003c\/dt\u003e\n\u003cdd\u003eActive\u003c\/dd\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"row\"\u003e\n\u003cdt\u003eCountry of origin\u003c\/dt\u003e\n\u003cdd\u003e🇦🇹 Austria\u003c\/dd\u003e\n\u003c\/div\u003e\n\u003c\/dl\u003e\u003c\/aside\u003e\n\u003c\/div\u003e\u003c\/div\u003e\n\u003cnav class=\"toc\" aria-label=\"Page sections\"\u003e\u003ca href=\"#what\"\u003eWhat is it\u003c\/a\u003e\u003ca href=\"#bestnot\"\u003eWhen to use THREATGET \/ When not to\u003c\/a\u003e\u003ca href=\"#how\"\u003eHow to use\u003c\/a\u003e\u003ca href=\"#proscons\"\u003ePros \u0026amp; Cons\u003c\/a\u003e\u003ca href=\"#pricing\"\u003ePricing\u003c\/a\u003e\u003ca href=\"#trust\"\u003eTrust \u0026amp; Privacy\u003c\/a\u003e\u003ca href=\"#watch\"\u003eWatch-outs\u003c\/a\u003e\u003ca href=\"#setup\"\u003eSetup \u0026amp; Integrations\u003c\/a\u003e\u003ca href=\"#company\"\u003eCompany\u003c\/a\u003e\u003ca href=\"#resources\"\u003eResources\u003c\/a\u003e\u003ca href=\"#faq\"\u003eFAQ\u003c\/a\u003e\u003ca href=\"#conclusion\"\u003eConclusion\u003c\/a\u003e\u003c\/nav\u003e\n\u003csection class=\"block\" id=\"what\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eOverview\u003c\/span\u003e\u003ch2\u003eWhat is THREATGET?\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"grid-2\"\u003e\n\u003cdiv class=\"rich justify\"\u003e\n\u003cp\u003e\u003cb\u003eTHREATGET\u003c\/b\u003e is a threat modelling and risk management tool for system design, developed by AIT Austrian Institute of Technology GmbH in Vienna. Its premise is that threat analysis is normally an expensive and subjective expert judgement; THREATGET formalises threat information into machine-readable rules so that the analysis becomes repeatable, updatable and auditable.\u003c\/p\u003e\n\u003cp\u003eThe workflow is model-driven. You draw the architecture of the system, with components, wired and wireless connectors, interfaces and ports, assets and trust boundaries, and the tool matches that model against a rule catalogue to return the threats that actually apply. It is a rule engine over a curated threat catalogue, not a generative assistant. Threats are typed with STRIDE; attack trees have given way to directed acyclic graphs to remove duplicated paths, and re-analysis is incremental, so the history of how a risk moved is preserved. Risk is scored as likelihood against impact on a five-by-five matrix, impact is broken down along the SFOP dimensions, and an optional attack feasibility rating follows ISO\/SAE 21434. Mitigations and design decisions stay traceable, and the resulting TARA report is downloaded as an xlsx file.\u003c\/p\u003e\n\u003cp\u003eThe model library is extensible. Domain catalogues such as ICS and Automotive can be downloaded and customised, users define their own elements, security properties and threats in a dedicated rule language edited in the web interface, published catalogue releases are immutable, and sandbox projects exist for catalogue development. A separate threat intelligence subscription keeps the model library and the threat catalogue current. Team work is supported through projects with Manage, Edit and Read roles, a Cybersecurity Architect role, single sign-on, LDAP and OIDC.\u003c\/p\u003e\n\u003cp\u003eThe announced target domains are automotive, railways, energy and critical infrastructure, plus IoT and cyber-physical systems. \u003cb\u003eOne caveat about the product's own description:\u003c\/b\u003e the homepage and the What is THREATGET page still present the tool as an extension of the Enterprise Architect modelling platform, while the version history records that from v24.04 the tool is \u003ci\u003ecompletely in the web\u003c\/i\u003e, and the current v2R5 documentation mentions Enterprise Architect only for importing legacy diagrams. The site never reconciles the two accounts. AIT also states that parts of THREATGET were developed in national and international research projects, and that a commercial version is available through ThreatGet 4Biz Consulting GmbH.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv\u003e\n\u003ch3 style=\"font-size:14px;margin-bottom:12px;color:var(--gv3-brand-ink);text-transform:uppercase;letter-spacing:.08em\"\u003eWhat it does\u003c\/h3\u003e\n\u003cul class=\"brand-list\"\u003e\n\u003cli\u003eModel a system architecture: components, wired and wireless connectors, interfaces and ports, assets and trust boundaries.\u003c\/li\u003e\n\u003cli\u003eIdentify the applicable threats automatically by running a rule-based threat catalogue against that model.\u003c\/li\u003e\n\u003cli\u003eGenerate attack paths and attack steps, now as directed acyclic graphs rather than duplicate-prone attack trees.\u003c\/li\u003e\n\u003cli\u003eAssess risk from likelihood and impact, with impact structured along the SFOP dimensions (safety, financial, operational, privacy).\u003c\/li\u003e\n\u003cli\u003eRate attack feasibility according to ISO\/SAE 21434 when that optional scoring is enabled.\u003c\/li\u003e\n\u003cli\u003ePropose mitigations and keep each one traceable back to the threat and forward to the design decision.\u003c\/li\u003e\n\u003cli\u003eExport the TARA report as an xlsx file for review, audit or certification evidence.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block soft\" id=\"bestnot\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eAudience\u003c\/span\u003e\u003ch2\u003eWhen to use THREATGET \/ When not to\u003c\/h2\u003e\n\u003cp class=\"lead\"\u003eA quick filter to help you decide if THREATGET is the right fit.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"bestnot\"\u003e\n\u003cdiv class=\"card for\"\u003e\n\u003ch3\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"16\" height=\"16\"\u003e\u003cpath d=\"M7 10v12\"\u003e\u003c\/path\u003e\u003cpath d=\"M15 5.88 14 10h5.83a2 2 0 0 1 1.92 2.56l-2.33 8A2 2 0 0 1 17.5 22H4a2 2 0 0 1-2-2v-8a2 2 0 0 1 2-2h2.76a2 2 0 0 0 1.79-1.11L12 2a3.13 3.13 0 0 1 3 3.88Z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e When to use THREATGET\u003c\/h3\u003e\n\u003cul class=\"brand-list\"\u003e\n\u003cli\u003eEngineering teams that must produce a traceable TARA (Threat Analysis and Risk Assessment) and keep it alive across a whole development cycle.\u003c\/li\u003e\n\u003cli\u003eAutomotive manufacturers and suppliers preparing cybersecurity type-approval under UNECE WP.29 and working to ISO\/SAE 21434.\u003c\/li\u003e\n\u003cli\u003eCertification and assessment bodies reviewing vehicle architectures, a group the product folder names explicitly.\u003c\/li\u003e\n\u003cli\u003eIndustrial automation and critical infrastructure teams, who can start from the ICS and Automotive threat catalogues.\u003c\/li\u003e\n\u003cli\u003eOrganisations that require an in-house deployment, because the server runs on their own infrastructure and the system models never leave it.\u003c\/li\u003e\n\u003cli\u003eUniversity research groups in embedded and automotive cybersecurity: Coventry University, Swansea University, Salzburg University of Applied Sciences and Mykolas Romeris University are named as references.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"card not\"\u003e\n\u003ch3\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"16\" height=\"16\"\u003e\u003cpath d=\"M17 14V2\"\u003e\u003c\/path\u003e\u003cpath d=\"M9 18.12 10 14H4.17a2 2 0 0 1-1.92-2.56l2.33-8A2 2 0 0 1 6.5 2H20a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2h-2.76a2 2 0 0 0-1.79 1.11L12 22a3.13 3.13 0 0 1-3-3.88Z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e When not to use THREATGET\u003c\/h3\u003e\n\u003cul class=\"brand-list\"\u003e\n\u003cli\u003eAnyone looking for a code scanner or a penetration-testing tool: THREATGET analyses an architecture model, not a running system.\u003c\/li\u003e\n\u003cli\u003eSecurity operations teams that need runtime detection, monitoring or incident response, none of which is in scope.\u003c\/li\u003e\n\u003cli\u003eIndividuals and small teams that want to sign up, pay online and start the same day: there is no public price, no free plan and no self-service trial, only a sales contact and a licence key.\u003c\/li\u003e\n\u003cli\u003eTeams that need to drive the tool from a CI pipeline or another application, since no product API is documented.\u003c\/li\u003e\n\u003cli\u003eOrganisations without IT support for the rollout: the server needs Linux, Docker and access to a private registry.\u003c\/li\u003e\n\u003cli\u003eUsers expecting a mobile app or a browser extension, neither of which exists.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block soft\" id=\"how\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eGet started\u003c\/span\u003e\u003ch2\u003eHow to use THREATGET\u003c\/h2\u003e\n\u003cp class=\"lead\"\u003eA typical end-to-end flow, from setup to results.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003col class=\"steps\"\u003e\n\u003cli\u003eStart with the commercial contact: the Partners page names ThreatGet 4Biz Consulting GmbH as the sales contact, and AIT issues the licence key.\u003c\/li\u003e\n\u003cli\u003eProvision a central Linux server, typically a virtual machine running Ubuntu 20.04 LTS or Debian, with outbound internet access.\u003c\/li\u003e\n\u003cli\u003eInstall Docker and Docker Compose, then authenticate against the private AIT registry (registry.threatget.com) with the credentials AIT supplies.\u003c\/li\u003e\n\u003cli\u003eFill in the deployment values: registry user and password, version and licence key from AIT, plus the database and web administrator passwords you choose yourself.\u003c\/li\u003e\n\u003cli\u003ePut the service behind a TLS terminator and restrict it to the corporate network, using VPN for remote staff; the guide exposes port 80 and leaves HTTPS to you.\u003c\/li\u003e\n\u003cli\u003eAllow the outbound connection to license.threatget.com for licence verification and element and rule updates, configuring HTTPS_PROXY_HOST and HTTPS_PROXY_PORT with certificate pinning if a proxy sits in the way.\u003c\/li\u003e\n\u003cli\u003eSet up authentication with single sign-on, LDAP or OIDC, then grant Manage, Edit or Read permissions per project.\u003c\/li\u003e\n\u003cli\u003eIn the browser, create a project, draw the architecture diagram and pick the threat catalogue to run against it.\u003c\/li\u003e\n\u003cli\u003eRun the analysis and work through the threats, attack graphs, attack steps and applied rules, using the Requires and Provides filters and the adversary capability filter.\u003c\/li\u003e\n\u003cli\u003eTreat the risks, record mitigations and design decisions, then download the TARA report as xlsx; an administrator tracks licence status, seat count, expiry and update period in the interface.\u003c\/li\u003e\n\u003c\/ol\u003e\u003c\/section\u003e\n\u003csection class=\"block\" id=\"proscons\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eQuick read\u003c\/span\u003e\u003ch2\u003ePros \u0026amp; Cons\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"grid-2\"\u003e\n\u003cdiv class=\"pc pros\"\u003e\n\u003ch3\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003ccircle cx=\"12\" cy=\"12\" r=\"10\"\u003e\u003c\/circle\u003e\u003cpath d=\"m9 12 2 2 4-4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Pros\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eBacked by a public research institute: the threat catalogue is maintained inside research projects, and four peer-reviewed publications from 2022 to 2025 (SAFECOMP, IDIMT, MDPI Information, IEEE ICPS) document the approach.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eExplicit alignment with the frameworks that matter in its sectors: ISO\/SAE 21434 attack feasibility scoring, IEC 62443, the Cyber Resilience Act and UNECE WP.29 type-approval.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eGenuinely maintained: a dense version history runs from v20.03 to v2R5, with the page last updated on 25\/06\/2026.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eOn-premise deployment keeps system models, often among the most sensitive artefacts an engineering team holds, on the customer's own infrastructure.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eEnd-to-end traceability from the identified threat through the mitigation to the design decision, with exportable reports.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eExtensible by design: catalogues, elements, security properties and rules can all be defined by the user, with sandbox projects for developing them safely.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolyline points=\"20 6 9 17 4 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e \u003cspan\u003eRecognised work and named references: the eAward 2020 in the Industry 4.0 category, first place at the Constantinus Award in the Digitalisation \/ Internet of Things category, a nomination for the 2022 Austrian Staatspreis, and testimonials from four named universities.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"pc cons\"\u003e\n\u003ch3\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"16\" height=\"16\"\u003e\u003ccircle cx=\"12\" cy=\"12\" r=\"10\"\u003e\u003c\/circle\u003e\u003cline x1=\"4.93\" y1=\"4.93\" x2=\"19.07\" y2=\"19.07\"\u003e\u003c\/line\u003e\u003c\/svg\u003e Cons\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eNo public pricing whatsoever: no pricing page, no amount and no currency symbol anywhere on the site or in the product documentation.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eNo free trial and no free plan is announced; the only route in is a sales contact followed by a licence key.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eNo documented product API, so the tool cannot be driven programmatically from a toolchain or a CI pipeline.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eHeavy installation: a dedicated Linux server, Docker, access to a private registry, and HTTPS left to the customer, since the deployment guide serves the application over plain HTTP on port 80. Deployment on Windows through Docker is not officially supported.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eThe website contradicts itself about the nature of the product: the homepage and the What is THREATGET page still describe an Enterprise Architect extension, although the product has been fully web-based since version 24.04.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eThe showcase site is poorly maintained: two Imprint pages coexist, an orphan page survives, no social profile is linked, an award name is misspelled on the homepage, and both announced commercial domains, threatget.eu and cybersecurity.lieberlieber.com, now redirect to threatget.com.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"18\" y1=\"6\" x2=\"6\" y2=\"18\"\u003e\u003c\/line\u003e\u003cline x1=\"6\" y1=\"6\" x2=\"18\" y2=\"18\"\u003e\u003c\/line\u003e\u003c\/svg\u003e \u003cspan\u003eNo DPA, no sub-processor list and no declared hosting country; documentation and interface are English only, the privacy policy is English with a German version on request, and contact enquiries are stored indefinitely.\u003c\/span\u003e\n\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block soft\" id=\"pricing\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003ePricing\u003c\/span\u003e\u003ch2\u003ePricing \u0026amp; Plans\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cp class=\"rich justify\" style=\"color:var(--gv3-ink-2);margin:0 0 18px;max-width:80ch\"\u003eNo price is published. Across the thirteen pages of the website and the whole of the product documentation there is not a single amount or currency symbol, so no free plan and no entry price can be stated here. What is documented is the structure. THREATGET is sold as a software licence, with a licence key issued by AIT and verified online against license.threatget.com. Two licensing models have been supported since v2R4, floating licences and named user licences, and the licence itself carries a number of available seats, an expiry date and an update period, all visible to an administrator inside the interface. A separate threat-database subscription is offered to keep receiving catalogue updates. Neither a free plan nor a self-service trial is announced. The only published route to a quotation is commercial: the Partners page names ThreatGet 4Biz Consulting GmbH as the sales contact, and the privacy policy confirms that THREATGET licence agreements and licensees exist.\u003c\/p\u003e\n\u003cdiv class=\"pricing-extras\"\u003e\u003cdiv class=\"affiliate-note\"\u003ePrices and plans listed above may evolve. Always check the official pricing page before subscribing.\u003c\/div\u003e\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block\" id=\"trust\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eTrust \u0026amp; Privacy\u003c\/span\u003e\u003ch2\u003eData, GDPR \u0026amp; hosting\u003c\/h2\u003e\n\u003cp class=\"lead\"\u003eA consolidated view of how THREATGET handles your data.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"trust-grid\"\u003e\n\u003cdiv class=\"col\"\u003e\n\u003cdiv class=\"trust-card\"\u003e\n\u003ch3\u003eGDPR overview\u003c\/h3\u003e\n\u003cp class=\"justify\" style=\"color:var(--gv3-ink-2);margin:0\"\u003eGDPR implementation is explicit. The policy is written as an Article 13 and Article 14 notice and names \u003cb\u003eAIT Austrian Institute of Technology GmbH\u003c\/b\u003e as controller, with a designated Data Protection Officer at dpo@ait.ac.at. It lists the rights of access, rectification, erasure, restriction, portability and objection, states that consent may be withdrawn at any time without affecting the lawfulness of earlier processing, and points to the Austrian data protection authority (www.dsb.gv.at) for complaints. Rights are exercised by writing to office@ait.ac.at, and retention periods are given per category of data. Because the controller is established in Austria, no Article 27 representative is required or named. The policy is published in English only, with a German version available on request. No data processing agreement and no sub-processor list are published.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"trust-card\"\u003e\n\u003ch3\u003eWho owns the data?\u003c\/h3\u003e\n\u003cp class=\"justify\" style=\"color:var(--gv3-ink-2);margin:0 0 12px\"\u003eThe Imprint states plainly that \u003cb\u003eAIT Austrian Institute of Technology GmbH\u003c\/b\u003e is the owner of the website, and the disclaimer reserves all site content, including copyrights, trademarks and patents, to AIT, permitting only personal and non-commercial use. The same company, at Giefinggasse 4, 1210 Vienna, Austria, is the declared controller for personal data, with a designated Data Protection Officer at dpo@ait.ac.at and a general contact at office@ait.ac.at. For the product itself the picture differs: because the server is installed on the customer's own Linux machine, the system models and analysis results stay on the customer's infrastructure rather than the publisher's. No licence terms covering ownership of customer content are published.\u003c\/p\u003e\n\u003ch3\u003eReuse rights\u003c\/h3\u003e\n\u003cp class=\"justify\" style=\"color:var(--gv3-ink-2);margin:0\"\u003eThe privacy policy describes what AIT does with personal data rather than what a reader may do with the site, and the disclaimer answers that second question restrictively: content may be used for personal, non-commercial purposes only, with all rights reserved to AIT. On the personal data side, licensee details (name, company, contact persons, contact details and the scope of the licence) are processed to fulfil THREATGET licence agreements, and the policy states that without this data a licence cannot be obtained. Visitor data, namely IP address, browser, date and time of the visit, and contact enquiries both rest on legitimate interest. THREATGET instances hosted by AIT, mostly for demonstration, additionally record the IP address, Windows computer name, Windows domain name and Windows user name of every person running an analysis. A single recipient is named, YouTube (YouTube, LLC), for embedded videos, and AIT states that it does not determine the purposes of YouTube's processing. Nothing is published about reusing content or analysis output, and the licence agreements themselves are not public.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"trust-card\"\u003e\n\u003ch3\u003eData retention \u0026amp; training\u003c\/h3\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eRetention summary\u003c\/div\u003e\n\u003cdiv class=\"v justify\"\u003eRetention is set out per category in the privacy policy. Licensee information is kept for as long as it is needed to manage the licences. Users who run an analysis on a THREATGET instance hosted by AIT have their data stored for 48 hours. Website visitor data is kept for 52 weeks. Contact enquiries and the contact details that come with them are stored indefinitely, the longest and least bounded period declared. Backups are taken at regular intervals and deleted only at certain points, for economic and technical reasons, and AIT states that technical and organisational measures restrict the processing of data held in backups until deletion. Cookies are mostly session cookies, with one year for wordpress_akm_mobile, one day for akm_mobile and 6160 days for the YouTube-nocookie consent cookie.\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eGDPR contact\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e\u003ca href=\"mailto:dpo@ait.ac.at\"\u003edpo@ait.ac.at\u003c\/a\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"col\"\u003e\u003cdiv class=\"trust-card\"\u003e\n\u003ch3\u003eHosting summary\u003c\/h3\u003e\n\u003cp class=\"justify\" style=\"color:var(--gv3-ink-2);margin:0 0 14px\"\u003eNo hosting country or region is declared, for the website or for the instances AIT operates. What the documentation does establish is the deployment model: the THREATGET server is installed and run by the customer, on the customer's own Linux server, so system models and analysis results stay inside the customer's own infrastructure and jurisdiction. That server needs one outbound connection, to license.threatget.com, for licence verification and for element and rule updates. Separately, AIT operates its own THREATGET instances, mostly for demonstration; those record the IP address and the Windows computer, domain and user names of everyone running an analysis, and no location is published for them. The controller for personal data is established in Austria, which places the site's processing inside the European Union, and as a matter of fact the website's server resolves to an address in Vienna. The site itself, however, makes no hosting declaration, so no hosting country is recorded in this listing. No sub-processor list and no data processing agreement are published either.\u003c\/p\u003e\n\u003c\/div\u003e\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block watch\" id=\"watch\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eWatch-outs\u003c\/span\u003e\u003ch2\u003eThings to keep in mind\u003c\/h2\u003e\n\u003cp class=\"lead\"\u003eRisks and trade-offs to weigh before adopting THREATGET.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cul class=\"brand-list\" style=\"grid-template-columns:repeat(2,1fr);display:grid;gap:12px 24px\"\u003e\n\u003cli\u003eThe site and the product disagree on what THREATGET is: the marketing pages describe an Enterprise Architect extension, while the version history and the current documentation describe a full web application since v24.04. Confirm what you are actually buying before you commit.\u003c\/li\u003e\n\u003cli\u003eThe company that sells is not the company that publishes the site: ThreatGet 4Biz Consulting GmbH (Handelskai 340, 1020 Vienna) handles sales, while AIT Austrian Institute of Technology GmbH owns the site and the research. Check which entity your contract is with, and who owes you support.\u003c\/li\u003e\n\u003cli\u003eThe commercial web presence has collapsed into a single domain: threatget.eu, still presented on the site as the product and consulting space, redirects to threatget.com, as does cybersecurity.lieberlieber.com. Two Imprint pages with different managing directors also coexist, the one linked in the navigation being the more recent.\u003c\/li\u003e\n\u003cli\u003eNo DPA, no sub-processor list and no declared hosting country are published. If you need any of them, make them a contractual requirement rather than assuming they exist.\u003c\/li\u003e\n\u003cli\u003eThe deployment guide serves the application over plain HTTP on port 80 and leaves TLS termination to you. Rolling it out as-is would expose credentials and threat models across your internal network.\u003c\/li\u003e\n\u003cli\u003eThe server needs a permanent outbound connection to license.threatget.com for licence verification and rule updates, which has to be planned for in an air-gapped or tightly filtered environment.\u003c\/li\u003e\n\u003cli\u003eAn automated threat list is an input to expert judgement, not a replacement for it. The catalogue can only find what its rules describe, the severity counts shown in the product folder are a demonstration example rather than a measured result, and a model that has drifted from the real system will quietly produce a clean and false analysis.\u003c\/li\u003e\n\u003c\/ul\u003e\u003c\/section\u003e\n\u003csection class=\"block\" id=\"setup\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eSetup\u003c\/span\u003e\u003ch2\u003eSetup \u0026amp; Integrations\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"setup-grid\"\u003e\n\u003cdiv class=\"setup-card\"\u003e\n\u003ch3 style=\"font-size:15px;margin-bottom:10px\"\u003eTechnical difficulty\u003c\/h3\u003e\n\u003cp class=\"justify\" style=\"color:var(--gv3-ink-2);margin:0 0 14px\"\u003eHigh for the installation, low for daily use. Setting up THREATGET is an IT task: a Linux server (Ubuntu 20.04 LTS or Debian, usually a virtual machine), Docker and Docker Compose, authentication against the private AIT registry, and five values to configure: registry user and password, version, licence key, plus database and administrator passwords. Outbound internet access is required. HTTPS is not provided, so a TLS terminator and a certificate fall to the customer, and an outbound proxy can be configured with certificate pinning. The documentation advises involving your IT department. End users then need only a browser.\u003c\/p\u003e\n\u003ch3 style=\"font-size:15px;margin:14px 0 10px\"\u003eDeployment\u003c\/h3\u003e\n\u003cdiv class=\"flag-row\"\u003e\u003cspan class=\"flag\"\u003eWeb app\u003c\/span\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"setup-card\"\u003e\n\u003ch3 style=\"font-size:15px;margin-bottom:10px\"\u003eIntegrations\u003c\/h3\u003e\n\u003cdiv class=\"integrations\"\u003e\n\u003cspan class=\"integration\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"M6.3 20.3a2.4 2.4 0 0 0 3.4 0L12 18l-6-6-2.3 2.3a2.4 2.4 0 0 0 0 3.4Z\"\u003e\u003c\/path\u003e\u003cpath d=\"m2 22 3-3\"\u003e\u003c\/path\u003e\u003cpath d=\"M7.5 13.5 10 11\"\u003e\u003c\/path\u003e\u003cpath d=\"M10.5 16.5 13 14\"\u003e\u003c\/path\u003e\u003cpath d=\"m18 3-4 4h6l-4 4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Enterprise Architect\u003c\/span\u003e\u003cspan class=\"integration\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"M6.3 20.3a2.4 2.4 0 0 0 3.4 0L12 18l-6-6-2.3 2.3a2.4 2.4 0 0 0 0 3.4Z\"\u003e\u003c\/path\u003e\u003cpath d=\"m2 22 3-3\"\u003e\u003c\/path\u003e\u003cpath d=\"M7.5 13.5 10 11\"\u003e\u003c\/path\u003e\u003cpath d=\"M10.5 16.5 13 14\"\u003e\u003c\/path\u003e\u003cpath d=\"m18 3-4 4h6l-4 4\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Docker\u003c\/span\u003e\n\u003c\/div\u003e\n\u003ch3 style=\"font-size:15px;margin:14px 0 10px\"\u003eSupported languages\u003c\/h3\u003e\n\u003cdiv class=\"flag-row\"\u003e\u003cspan class=\"flag\"\u003eEnglish\u003c\/span\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block soft\" id=\"company\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eCompany\u003c\/span\u003e\u003ch2\u003eBehind THREATGET\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"company-card\"\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eCompany name\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e\u003cb\u003eAIT Austrian Institute of Technology GmbH\u003c\/b\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eFounded\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003eINFORMATION_NOT_FOUND\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eCountry of origin\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e🇦🇹 Austria\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eHeadquarters\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003eGiefinggasse 4, 1210 Vienna, Austria\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eUBO\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003eRepublic of Austria\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eUBO country\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e🇦🇹 Austria\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eDomain registrar country\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e🇩🇩 Germany\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eLegal contact\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e\u003ca href=\"mailto:cmc@ait.ac.at\"\u003ecmc@ait.ac.at\u003c\/a\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"kv\"\u003e\n\u003cdiv class=\"k\"\u003eSupport contact\u003c\/div\u003e\n\u003cdiv class=\"v\"\u003e\u003ca href=\"mailto:threatget@ait.ac.at\"\u003ethreatget@ait.ac.at\u003c\/a\u003e\u003c\/div\u003e\n\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block\" id=\"resources\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eOfficial links\u003c\/span\u003e\u003ch2\u003eResources\u003c\/h2\u003e\n\u003cp class=\"lead\"\u003eAll the official URLs gathered for verification and reference.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"res-grid\"\u003e\n\u003ca class=\"res\" href=\"https:\/\/www.threatget.com\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003ccircle cx=\"12\" cy=\"12\" r=\"10\"\u003e\u003c\/circle\u003e\u003cpath d=\"M12 2a14.5 14.5 0 0 0 0 20 14.5 14.5 0 0 0 0-20\"\u003e\u003c\/path\u003e\u003cpath d=\"M2 12h20\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003cdiv class=\"res-text\"\u003e\n\u003cdiv\u003eHomepage\u003c\/div\u003e\n\u003cdiv class=\"url\"\u003ewww.threatget.com\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/a\u003e\u003ca class=\"res\" href=\"https:\/\/www.threatget.com\/what-is\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpolygon points=\"12 2 2 7 12 12 22 7 12 2\"\u003e\u003c\/polygon\u003e\u003cpolyline points=\"2 17 12 22 22 17\"\u003e\u003c\/polyline\u003e\u003cpolyline points=\"2 12 12 17 22 12\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e\u003cdiv class=\"res-text\"\u003e\n\u003cdiv\u003eFeatures\u003c\/div\u003e\n\u003cdiv class=\"url\"\u003ewww.threatget.com\/what-is\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/a\u003e\u003ca class=\"res\" href=\"https:\/\/www.threatget.com\/what-is\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003ccircle cx=\"12\" cy=\"12\" r=\"10\"\u003e\u003c\/circle\u003e\u003cline x1=\"12\" y1=\"16\" x2=\"12\" y2=\"12\"\u003e\u003c\/line\u003e\u003cline x1=\"12\" y1=\"8\" x2=\"12.01\" y2=\"8\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003cdiv class=\"res-text\"\u003e\n\u003cdiv\u003eAbout\u003c\/div\u003e\n\u003cdiv class=\"url\"\u003ewww.threatget.com\/what-is\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/a\u003e\u003ca class=\"res\" href=\"https:\/\/www.threatget.com\/partners\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003crect x=\"2\" y=\"4\" width=\"20\" height=\"16\" rx=\"2\"\u003e\u003c\/rect\u003e\u003cpath d=\"m22 7-10 5L2 7\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003cdiv class=\"res-text\"\u003e\n\u003cdiv\u003eContact\u003c\/div\u003e\n\u003cdiv class=\"url\"\u003ewww.threatget.com\/partners\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/a\u003e\u003ca class=\"res\" href=\"https:\/\/www.threatget.com\/disclaimer\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z\"\u003e\u003c\/path\u003e\u003cpolyline points=\"14 2 14 8 20 8\"\u003e\u003c\/polyline\u003e\u003cline x1=\"16\" y1=\"13\" x2=\"8\" y2=\"13\"\u003e\u003c\/line\u003e\u003cline x1=\"16\" y1=\"17\" x2=\"8\" y2=\"17\"\u003e\u003c\/line\u003e\u003cpolyline points=\"10 9 9 9 8 9\"\u003e\u003c\/polyline\u003e\u003c\/svg\u003e\u003cdiv class=\"res-text\"\u003e\n\u003cdiv\u003eTerms\u003c\/div\u003e\n\u003cdiv class=\"url\"\u003ewww.threatget.com\/disclaimer\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/a\u003e\u003ca class=\"res\" href=\"https:\/\/www.threatget.com\/datapolicy\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cpath d=\"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003cdiv class=\"res-text\"\u003e\n\u003cdiv\u003ePrivacy policy\u003c\/div\u003e\n\u003cdiv class=\"url\"\u003ewww.threatget.com\/datapolicy\u003c\/div\u003e\n\u003c\/div\u003e\u003c\/a\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block\" id=\"faq\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eFAQ\u003c\/span\u003e\u003ch2\u003eFrequently asked questions\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"faq\"\u003e\n\u003cdetails\u003e\u003csummary\u003eWhat does THREATGET actually do? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eIt models a system architecture and automatically identifies the threats that apply to it, by running a rule-based threat catalogue against the model. It then scores the risk, proposes mitigations and produces a TARA report that can be downloaded as xlsx.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eWhich domains is it built for? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eAIT announces automotive, railways, energy and critical infrastructure, plus IoT and cyber-physical systems. Domain catalogues are provided for ICS and Automotive, and further catalogues can be built, customised and published.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eIs it an Enterprise Architect extension or a web application? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eIt began as an extension. The marketing pages still describe the tool as extending the Enterprise Architect modelling platform, but the version history records that from v24.04 it moved completely to the web, and the current v2R5 documentation mentions Enterprise Architect only for importing legacy diagrams through a JSON export. Worth clarifying with the publisher before you commit.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eHow is it deployed? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eAs a server on your own infrastructure: a central Linux machine, typically Ubuntu 20.04 LTS or Debian, running the application through Docker and Docker Compose from the private AIT registry. Users then connect with a web browser. Deployment on Windows through Docker is technically possible but not officially supported.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eWhat does it cost? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eNothing is published: neither the website nor the documentation states any amount or currency. The product is licensed, with a key issued by AIT, and both floating and named user licences are supported. A separate threat-database subscription is offered. Quotations go through the sales contact, ThreatGet 4Biz Consulting GmbH.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eIs there a free trial or a free plan? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eNone is announced. The only occurrence of the word demo on the site is in the privacy policy, describing THREATGET instances that AIT hosts mainly for demonstration purposes; that is a description of data processing, not an offer you can sign up for.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eDoes THREATGET have an API? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eNo product API is documented. The full product documentation runs to 294 pages without a single API reference, and the site makes no API claim, so external automation is not available today.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eWhich standards and regulations does it address? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eAttack feasibility rating follows ISO\/SAE 21434, and STRIDE is used to type the threats. AIT's published research addresses IEC 62443 and the Cyber Resilience Act, and the product folder frames the tool in the context of UNECE WP.29 cybersecurity type-approval.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eWho publishes the tool, and who sells it? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eThe website is published by AIT Austrian Institute of Technology GmbH in Vienna, which declares itself the owner of the site. The commercial version is distributed by a separate company, ThreatGet 4Biz Consulting GmbH; the 2021 product folder also names LieberLieber Software GmbH as a co-developer.\u003c\/div\u003e\u003c\/details\u003e\u003cdetails\u003e\u003csummary\u003eDo my system models leave my organisation? \u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"14\" height=\"14\"\u003e\u003cline x1=\"12\" y1=\"5\" x2=\"12\" y2=\"19\"\u003e\u003c\/line\u003e\u003cline x1=\"5\" y1=\"12\" x2=\"19\" y2=\"12\"\u003e\u003c\/line\u003e\u003c\/svg\u003e\u003c\/summary\u003e\u003cdiv class=\"ans justify\"\u003eIn the standard deployment the server runs on your own infrastructure, so the models stay there; the only outbound traffic described is licence verification and rule updates. The exception is the THREATGET instances hosted by AIT, mostly for demonstration, which record the IP address and the Windows computer, domain and user names of every person running an analysis.\u003c\/div\u003e\u003c\/details\u003e\n\u003c\/div\u003e\u003c\/section\u003e\n\u003csection class=\"block conclusion\" id=\"conclusion\"\u003e\u003cdiv class=\"head\"\u003e\n\u003cspan class=\"eyebrow\"\u003eConclusion\u003c\/span\u003e\u003ch2\u003eShould you pick THREATGET?\u003c\/h2\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"rich justify\" style=\"max-width:80ch\"\u003e\n\u003cp\u003eTHREATGET is a niche tool, but a serious and well documented one. Its value comes from a specific combination: a threat catalogue maintained by a public research institute, an analysis that runs automatically against your own architecture model, and the traceability that sector frameworks such as ISO\/SAE 21434, IEC 62443 and UNECE WP.29 type-approval demand. If your team has to produce a defensible TARA and keep it alive across a development cycle, that combination is hard to assemble from generic security tooling.\u003c\/p\u003e\n\u003cp\u003eTwo constraints should shape the decision. The first is commercial opacity: no price, no currency and no self-service trial exist in public, so every evaluation begins with a sales conversation, and with ThreatGet 4Biz Consulting GmbH rather than with AIT, which publishes the site. The second is operational: this is a server product. You supply a Linux machine, Docker, outbound access to the licence server and the TLS layer the deployment guide leaves to you. In exchange, your system models stay inside your own infrastructure.\u003c\/p\u003e\n\u003cp\u003eTreat the showcase site as the weakest source in the file. It still describes an Enterprise Architect extension although the product has been fully web-based since v24.04, it carries two Imprint pages and a misspelled award name, and it points to a commercial domain that now redirects back to itself. The version history and the product documentation are current, detailed and far more reliable. Note also what the tool is not: a rule engine over a curated catalogue, not a generative assistant, and not a scanner of running systems.\u003c\/p\u003e\n\u003cp\u003eFor automotive, rail, energy and industrial teams with in-house IT support and a compliance obligation, THREATGET deserves a conversation. For anyone hoping to sign up online and start this afternoon, it is the wrong product.\u003c\/p\u003e\n\u003c\/div\u003e\n\u003cdiv class=\"cta-row\"\u003e\u003ca class=\"btn btn-primary\" href=\"https:\/\/www.threatget.com\/\" target=\"_blank\" rel=\"noopener\"\u003e\u003csvg viewbox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" width=\"16\" height=\"16\"\u003e\u003cpath d=\"M15 3h6v6\"\u003e\u003c\/path\u003e\u003cpath d=\"M10 14 21 3\"\u003e\u003c\/path\u003e\u003cpath d=\"M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6\"\u003e\u003c\/path\u003e\u003c\/svg\u003e Visit THREATGET\u003c\/a\u003e\u003c\/div\u003e\u003c\/section\u003e\n\u003c\/div\u003e","brand":"AIT Austrian Institute of Technology GmbH","offers":[{"title":"Default Title","offer_id":58389907112267,"sku":null,"price":0.0,"currency_code":"EUR","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1038\/0905\/7099\/files\/official-threatget-by-guidaio_a041d427-4473-4209-9c35-4eca212f095f.png?v=1788736942","url":"https:\/\/guidaio.com\/products\/threatget","provider":"Guidaio","version":"1.0","type":"link"}