Threat models that draw themselves from your infrastructure.
Kresheen reads your Kubernetes manifests, Terraform and GitHub repositories, draws the data flow diagram with its trust boundaries, and ranks the threats that actually apply. Self-hosted. Rule-based. The same input always gives the same answer.
docker compose up -d --build
- Kubernetes YAML
- Terraform
- GitHub repos + SBOM
- Threat Dragon
- draw.io
- Mermaid
- Threagile
How it works
From config files to a fix list in one run
Point it at your system
Upload manifests or a Terraform plan, connect a GitHub repository, import a diagram, or answer a few plain questions. No agents to install.
Get the model, drawn for you
Components, data flows and trust boundaries become an editable data flow diagram. Add the facts only you know, like what stores card data.
Fix what matters first
Threats are scored by impact and real evidence such as known-exploited CVEs, then grouped into an action plan by the fix that closes them.
The product
One place to see the design, the threats and the plan
Every model at a glance: what is open, what is critical, and whether the trend is going the right way.
An editable diagram with trust boundaries. Rings show where the high and critical risk sits.
Each threat says why it is listed: observed in your configuration, specific to facts you stated, or a generic checklist item.
Fixes ranked so the misconfigurations found in your files come first, with the number of threats each one closes.
Built for engineers
Everything a threat model needs, nothing it does not
STRIDE for every element
Every component, data store, flow and trust boundary gets STRIDE threats, plus custom threats of your own.
Evidence-based risk
Vulnerabilities from a Grype SBOM scan raise likelihood when they are known-exploited or likely to be, using CISA KEV and EPSS.
Attack paths
See every route from the internet to your data stores and which hops lack authentication.
A gate in CI
kresheen ci and a GitHub Action fail a pull request that adds new high risk or a new flow across a trust boundary.
History and diffs
Every run is kept. Compare runs, spot stale models and watch the trend per model.
Reports people read
PDF, Word and HTML reports, CSV, SARIF, SVG and PNG diagrams, and Threat Dragon JSON.
Deterministic by design
No guessing. No surprises in review.
Kresheen is rule-based, so a threat is listed only when a rule matches something your files or your answers state. Run it twice and you get the same result. That makes it safe to put in a pipeline.
- Runs on your own hardware. Nothing leaves it unless you connect a repository or turn on AI.
- Optional AI assist drafts intake answers and explains a threat. It never writes threats or findings.
- SQLite for a laptop, PostgreSQL and a Helm chart for a team.
Open source
Kresheen
Free, forever
The threat-modeling engine, STRIDE threats, diagrams, action plan, CI gate and exports. No licence checks.
Get the codeFor organisations
Kresheen Pro
Coming soon
An extended threat knowledge base and methodology coverage, single sign-on, SCIM, restricted groups with roles, reviewed guidance, a Jira connector, a portfolio dashboard and audit streaming.
Compare editionsYour first threat model is five minutes away
Clone it, follow the quickstart in the README to start it and create your account, then open the sample model to see what a finished model looks like.