1
Sketch it
Drag in the pieces of your system, like your website, database, payments and login, and connect them with arrows. No jargon, no notation to learn.
New Introducing Parapet Studio
Threat modeling.
Finally obvious.
Sketch your system the way you would on a whiteboard. Parapet instantly shows every way it could be attacked, ranks what matters most, and tells you exactly how to fix it, in plain English.
Runs entirely in your browser. Your diagrams never leave your device.
0
building blocks across AWS, Azure, Google Cloud, self-hosted & SaaS
0
threat rules, each with step-by-step fixes
STRIDE
every threat classified and mapped to MITRE ATT&CK
0
sign-ups, installs or security degrees required
Ready-made blocks for the stack you already run, including
How it works
Three steps.
That's genuinely it.
Threat modeling used to mean week-long workshops, giant spreadsheets and a consultant. Parapet turns it into something anyone on your team can do before lunch.
2
See it
Parapet instantly finds the threats, from SQL injection to leaked keys, ranks them by real risk, and explains each one in a sentence your CEO would understand.
3
Fix it
Every threat comes with a checklist of proven fixes. Tick them off and watch your security grade climb from F to A, with a report ready for auditors.
Live demo · no sign-up
Pick your stack.
Watch the risks appear.
This is the real Parapet engine running right here on the page. Toggle the pieces your product uses, then flip the switches to see how good security choices change the picture.
What your product has
Protection in front
Good habits
Built-in expertise
Every threat
comes with the fix.
No more vague warnings. Each finding tells you what could happen, how bad it would be, and the exact steps that stop it. Go on, tick a box.
- Plain-English first. One clear sentence, then the technical detail for your engineers.
- Industry-standard mapping. STRIDE categories and MITRE ATT&CK techniques on every threat. MITRE ATLAS for AI.
- Cloud-aware advice. Recommends the native tool for AWS, Azure or Google Cloud.
- Risk that responds. Residual risk drops as you put mitigations in place.
Customer Database · Amazon RDSSQL Injection
Open
Current riskCritical
19 / 25
How to fix it
Parapet Studio
Simple on the surface.
Serious underneath.
Beginners get clarity. Security teams get rigor. Everything you'd expect from enterprise threat-modeling tools, without the learning curve.
Threats in words humans use.
Every finding is written as a clear threat statement: who could do what, to which part of your system, and what happens next.
Critical
“Someone could type database commands into a form and trick Orders Database into leaking your restricted data.”
High
“If App Server 1 is compromised, an attacker could use it as a stepping stone to reach your other systems.”
SSpoofingTTamperingRRepudiationIDisclosureDDenialEElevation
STRIDE + MITRE ATT&CK.
Every threat is classified and linked to real attacker techniques, so your security team can trust the output.
Public
Private
Restricted
Trust zones that matter.
Draw Public, Private and Restricted zones. Risk adjusts automatically, and connections that cross a boundary get extra scrutiny.
APIInternal → Restricted
Customer DBRestricted
Sensitivity that flows.
Anything that touches your crown-jewel data inherits its importance. Parapet traces it for you.
Web firewall
SQL injection CoveredXSS CoveredSSRF Covered
Smart protection.
Put a firewall, CDN or API gateway in front and Parapet credits the threats it neutralizes downstream.
Reports your auditor will actually like.
One click turns your model into a polished report with a security grade, a ranked threat register, STRIDE breakdown and mitigation status. Export to PDF, CSV, Markdown, JSON, PNG or SVG.
B
PDFCSVMDJSONPNGSVG
Private by design.
Parapet runs 100% in your browser. Nothing is uploaded, ever. Your architecture stays yours.
Speaks every stack.
Hundreds of ready-made blocks for the clouds and tools you already use, plus custom blocks for anything else.
Blueprints
Don't start from
a blank page.
Load a ready-made architecture, explore its threats, then make it your own. Each blueprint opens in the Studio in one click.
Made for the whole team
Whoever you are,
it just makes sense.
Founders & product managers
Understand your real risks before a customer, investor or regulator asks. No translator needed.
- Plain-English findings
- A single grade to track
- Shareable reports
Engineers & architects
Threat-model a feature in the same meeting you design it. Ship with confidence, not guesswork.
- Cloud-native blocks
- Concrete, testable fixes
- JSON in, JSON out
Security & compliance
Scale your security team's judgment across every squad, and keep evidence that it happened.
- STRIDE & MITRE ATT&CK mapping
- Status tracking & notes
- Audit-ready exports
Why Parapet
The old way had
its moment.
The old way Parapet
Time to first threat modelDays to weeksMinutes
Who can do itSecurity specialistsAnyone on the team
Where it livesWhiteboard photos & spreadsheetsA living, interactive diagram
How findings readAcronyms & jargonPlain English, plus the detail
What to do next“Consult your security team”A ticked-off checklist
Cost to get startedConsultants & licensesFree
Pricing
Start free.
Grow when you're ready.
Personal
For individuals learning the ropes.
$0forever
Start free
- Unlimited diagrams, saved in your browser
- All 245 building blocks
- Full threat library & fixes
- Security grade & insights
- PNG, SVG & JSON export
Pro
For teams shipping to production.
$19per user / month
Try Pro free for 14 days
- Everything in Personal
- Audit-ready PDF, CSV & Markdown reports
- Custom blocks & custom threats
- Status tracking, notes & assumptions
- Priority threat-rule updates
Enterprise
For security & compliance programs.
Customannual agreement
Talk to sales
- Everything in Pro
- SSO / SAML & role-based access
- Shared workspaces & review workflows
- Self-hosted deployment option
- Dedicated success manager
FAQ
Questions,
answered.
What is threat modeling, in plain English?
It's thinking like an attacker before an attacker does. You look at how your system is put together, ask “what could go wrong here?”, and decide what to do about it. Parapet does the asking for you and turns the answers into a to-do list.
Do I need to be a security expert?
No. If you can draw boxes and arrows, you can use Parapet. Every threat is explained in one plain sentence, with the technical detail tucked underneath for when you need it.
Where is my data stored?
On your device. The Studio runs entirely in your browser and saves automatically to local storage. Nothing is sent to a server. Export a JSON file whenever you want a backup or to share with a teammate.
Which clouds and tools are supported?
Amazon Web Services, Microsoft Azure, Google Cloud, popular self-hosted and open-source software, and dozens of SaaS products like Stripe, Auth0, Okta, GitHub and OpenAI. Anything missing can be added as a custom block that behaves like the closest type.
What methodology does Parapet use?
Threats are classified with STRIDE and mapped to MITRE ATT&CK techniques (and MITRE ATLAS for AI systems). Risk is likelihood × impact, adjusted for data sensitivity, trust zone, internet exposure and the protections upstream of each component.
How is the security grade calculated?
Your score is the share of total risk you've addressed, from 0 to 100. Mitigated threats count fully, partially-fixed threats count in proportion to the checklist items you've completed, and accepted risks don't improve the score. 90+ is an A.
Your system has threats.
Now you can see them.
Open the Studio and model your first system in minutes. Free, private, no account needed.