Fork vs. IriusRisk

Fork vs. IriusRisk: Which Threat Modeling Platform Fits Your Program?

Fork and IriusRisk both help organizations scale threat modeling, but they are built around different starting points.

Fork is a continuous application threat modeling platform built around PASTA, the seven-stage Process for Attack Simulation and Threat Analysis. It emphasizes business context, relevant threat intelligence, weakness and vulnerability data, attack viability, business impact, residual risk, and an evolving view of application risk.

IriusRisk presents itself as a methodology-agnostic, AI-assisted secure-design and threat modeling platform. It emphasizes architecture diagramming, automated threat and countermeasure generation, reusable security content, developer self-service, compliance support, integrations, and enterprise-wide secure-design workflows.

The better fit depends on what an organization expects threat modeling to accomplish. Teams that want PASTA operationalized as a risk-centric process may favor Fork. Teams that prioritize diagram-led secure design, broad methodology flexibility, and AI-assisted model creation may favor IriusRisk.

The practical distinction

Fork is more prescriptive about the PASTA process. IriusRisk is more flexible about methodology and offers a strong diagram-led, secure-design operating model. Organizations should decide whether methodological consistency or methodology flexibility is more important to their program.

Which approach is better?

A prescriptive PASTA foundation can improve consistency when the organization wants a risk-centric process tied to business impact and realistic attack analysis. A methodology-agnostic platform can provide more flexibility when teams have existing practices, regulatory requirements, or architecture standards they do not want to replace.

Buyer consideration

Ask both vendors to demonstrate the full reasoning behind a priority. The platform should show which context, threat, weakness, control, likelihood, feasibility, and impact factors influence the result. A score without explainable inputs is not enough for an enterprise risk decision.

AI-Assisted Threat Modeling

Buyer consideration

AI speed should not be the only selection criterion. Ask how outputs are grounded, reviewed, versioned, explained, approved, and audited. Determine whether AI recommendations can be traced to architecture, threat sources, controls, and risk assumptions.

Buyer consideration

Compare content quality rather than content volume. Ask how often libraries are updated, whether sources are visible, how false positives are handled, whether proprietary content can be added, and how changes affect existing models.

Buyer consideration

Ask for a live demonstration of the exact integration you need. Confirm what data enters the model, what can be written back, how conflicts are resolved, how frequently synchronization occurs, and whether the integration is generally available or planned.

Buyer consideration

Both vendors use continuous-modeling language. Require each to demonstrate how a model changes after an architecture update, a new vulnerability, a closed ticket, a changed security control, and new threat intelligence. Continuity should be observable, not just a marketing description.

Buyer consideration

Compare approval workflows, ownership, role design, separation of duties, audit evidence, reusable patterns, exceptions, risk acceptance, reporting, and administration. Enterprise scale is an operating-model question, not merely a license limit

Buyer consideration

Community editions are useful for learning workflows, but they may not represent enterprise governance, integration, deployment, support, or scale. Use them to evaluate usability and modeling logic, then validate enterprise requirements separately.

Buyer consideration

Threat models can reveal sensitive architecture, weaknesses, controls, and business impact. Treat platform security and data portability as selection criteria equal to product functionality.

Buyer consideration

Software can standardize and accelerate a process, but high-risk systems may still require experienced threat modelers and offensive-security practitioners to challenge assumptions and validate attack viability.

ThreatModeler announced its acquisition of IriusRisk on January 8, 2026. IriusRisk continues to maintain its own product website and documentation, while ThreatModeler has described the transaction as bringing together two enterprise threat modeling platforms.

The acquisition does not, by itself, determine whether IriusRisk is a good or poor choice. It does create additional due-diligence questions for buyers:

• Will IriusRisk remain a distinct platform?
• How will the IriusRisk and ThreatModeler roadmaps be coordinated?
• Will licensing, packaging, support, or deployment options change?
• Will customers need to migrate models, content, integrations, or workflows?
• Which product will receive new capabilities first?
• How will data, support, and account responsibilities be managed across the combined organization?
• What contractual protections exist if the product strategy changes?

Organizations that prefer an independent platform built specifically around PASTA may include Fork in their evaluation. The comparison should remain focused on methodology, capabilities, operating model, and verified customer requirements rather than speculation about the acquisition.

Fork may be the stronger candidate when the organization:

• Wants a platform explicitly structured around all seven stages of PASTA
• Needs business impact and residual risk to drive prioritization
• Wants to connect threat modeling with vulnerability data and threat intelligence
• Needs to examine realistic attack paths and exploitability
• Wants threat models to evolve continuously with application and security data
• Values integrated offensive-security testing or expert-led threat modeling services
• Prefers an independent threat modeling product outside the ThreatModeler and IriusRisk combination

IriusRisk may be the stronger candidate when the organization:

• Prioritizes diagram-led secure-design workflows
• Wants integrated Draw.io functionality and broad architecture import options
• Needs a methodology-agnostic platform that can adapt to established internal practices
• Wants generative AI assistance for creating diagrams and threat models
• Needs reusable content, rules, countermeasures, and compliance mappings
• Plans to distribute self-service threat modeling across development and engineering teams
• Requires on-premises or specific regional hosting options and confirms those options are available

1. Show how the platform moves from business context to prioritized risk.
2. Demonstrate how a new application architecture is created or imported.
3. Explain which methodology drives the workflow and how it can be changed.
4. Show why a specific threat applies to a component or data flow.
5. Demonstrate how weaknesses and vulnerability findings alter the threat model.
6. Show an end-to-end attack scenario and the controls that interrupt it.
7. Explain the risk formula and every factor influencing the score.
8. Demonstrate how residual risk changes after a control is implemented.
9. Show how the model changes after an architecture update.
10. Demonstrate the exact integrations required by the organization.
11. Show audit history, approvals, permissions, and risk-acceptance workflows.
12. Explain how AI-generated content is grounded, reviewed, and governed.
13. Show what data can be exported if the organization changes platforms.
14. Explain current deployment, hosting, retention, and data-security options.
15. Provide the current roadmap and explain how the IriusRisk acquisition affects it.

Fork and IriusRisk address overlapping enterprise threat modeling requirements, but their philosophies are different.

Fork operationalizes PASTA as a continuous, risk-centric application threat modeling process. Its differentiation is strongest when an organization wants to connect business context, industry threats, weaknesses, vulnerability data, attack scenarios, security controls, and residual risk in one evolving model.

IriusRisk operationalizes secure design through architecture modeling, automated threat and countermeasure generation, reusable content, integrations, AI assistance, and methodology flexibility. Its differentiation is strongest when teams want a diagram-led platform that can distribute secure-design work across engineering and security users.

The selection should be based on a representative application and a documented evaluation scorecard. Ask each vendor to model the same architecture, use the same business context, ingest the same findings, and explain the resulting priorities. The better platform is the one that produces a threat model your teams can understand, defend, maintain, and act on.

Evaluate Fork against your threat modeling requirements

See how Fork applies PASTA to business-aligned, continuous application threat modeling.

Explore Fork

Talk With a Threat Modeling Expert

Is Fork an alternative to IriusRisk?

Yes. Fork is an IriusRisk alternative for organizations seeking a continuous application threat modeling platform built specifically around PASTA. The best fit depends on methodology, architecture workflow, AI requirements, integrations, governance, deployment, and the organization’s approach to risk.

Does IriusRisk support PASTA?

IriusRisk describes its platform as methodology-agnostic, which suggests organizations can configure it around different approaches. Buyers requiring full PASTA execution should ask IriusRisk to demonstrate how all seven PASTA stages are represented, governed, and reported within the platform.

Does Fork support AI threat modeling?

Fork emphasizes automated threat intelligence correlation, industry threat libraries, vulnerability ingestion, taxonomy mapping, risk calculations, and continuous updates. Organizations specifically seeking generative AI features should verify Fork’s current capabilities and roadmap directly with the vendor.

Which platform is better for business-risk analysis?

Fork is explicitly positioned around risk-centric PASTA analysis, business impact, attack feasibility, and residual risk. IriusRisk also supports risk views, threats, countermeasures, and compliance analysis. Buyers should require both platforms to explain their risk calculations using the same representative application.

Which platform is better for architecture diagramming?

IriusRisk has a clearly documented architecture-led workflow with integrated Draw.io functionality, trust zones, data-flow diagrams, components, questionnaires, templates, and imports. Fork supports application decomposition and component-level modeling, but buyers should compare the specific diagramming and import workflow against their architecture practices.

Can Fork and IriusRisk integrate with DevSecOps tools?

Both platforms document integrations with engineering and security workflows. Fork emphasizes vulnerability, AppSec, threat intelligence, and service-management data. IriusRisk emphasizes issue tracking, architecture, infrastructure as code, scanning, and development workflows. Availability and depth should be verified for each required connector.

Are Fork and IriusRisk free?

Both provide limited free entry points. Fork Community supports one application and one user. IriusRisk offers a Community Edition with selected capabilities and access to Jeff AI. Enterprise governance, integrations, support, scale, and deployment options require separate evaluation.

Who owns IriusRisk?

ThreatModeler announced that it acquired IriusRisk on January 8, 2026. IriusRisk continues to maintain product-facing resources. Buyers should confirm the current product roadmap, licensing, support, and integration strategy with the combined organization.

Is Fork independent of ThreatModeler and IriusRisk?

Yes. Fork is a VerSprite product and is independent of the ThreatModeler and IriusRisk organization. It is built around PASTA, which was co-created by VerSprite CEO Tony UcedaVélez and Marco M. Morana.