IriusRisk
- Company typePrivate
- Founded2015
- HeadquartersHuesca, Spain
- Headcount101–250
- GTM typeB2B
- OfferingSoftware
IriusRisk firmographics
Firmographics- Name
- IriusRisk
- Legal name
- IRIUSRISK, S.L.
- Website
- https://iriusrisk.com
- Company type
- Private
- Founded year
- 2015
- Operating status
- Acquired
- Headcount range
- 101–250 employees
- Ownership category
- akta.pro rank
IriusRisk industry classification
Industry- Product category
- Application Security Software
- NAICS
- Software Publishers (5132)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Enterprise AI Governance, Risk & Compliance Platforms (Model Risk, Audit, Policies) (HDAEANAE)
- akta.pro secondary industries
- Model Governance, Risk & Compliance (GRC) Platforms (HDAAAKAA), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG), AI Governance, Risk & Compliance (GRC) Platforms (HDAAAMAA), Third-Party Model/Vendor Risk & Supply-Chain Assurance (HDAAAMAK), Threat Intelligence Services (BPAEADAC)
Keywords
Where IriusRisk is headquartered
LocationHeadquarters
- HQ city
- Huesca
- HQ country
- Spain
- HQ region
- Europe
Offices3 records
Markets served
IriusRisk business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations
Revenue model
- Software Subscription: Subscription-based access to the IriusRisk threat modeling platform with tiered plans for different organizational needs. Includes enterprise and team editions.
- Professional Services: Tailored services including threat modeling training, implementation support, and consulting to help organizations elevate their threat modeling programs
- Free Community Edition: Free-forever community edition providing threat modeling tools and libraries at no cost, serving as a lead generation and community building mechanism
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Community Edition - Free forever |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels8 records
IriusRisk product offering
Product offeringCore offering
IriusRisk sells an automated threat modeling platform that uses a rules engine to generate threat models, threats, and countermeasures from architecture diagrams and infrastructure-as-code definitions. The platform integrates into the software development lifecycle and is supplemented by Jeff AI for AI-assisted diagram creation, Bex AI for in-Jira security assessment, a community edition, and tailored professional services.
Product overview
IriusRisk is an automated threat modeling platform that enables organizations to integrate security into their software development process from design through deployment. The core platform is supplemented by Jeff AI for AI-augmented diagram creation, Security Content Libraries with nearly 700 components and compliance mappings, and IriusRisk Reporting for advanced analytics. The platform is available in cloud and on-premise deployments across multiple global regions including US, UK, Ireland, Saudi Arabia, India, Thailand, and Australia, with a free Community Edition for individual users. Integration options include support for IaC formats (AWS CloudFormation, Terraform), diagramming tools (Visio, Lucidcharts), and API-based connectivity to security testing and DevOpSec workflows.
Differentiator
Problem solved
Functional benefit
Brands
- Jeff AI: AI-powered threat modeling assistant that aids in diagram creation and saves time.
- Bex AI
Products and services
- IriusRisk Threat Modeling Platform Automated threat modeling platform with a rules engine that generates threat models, threats, and security controls from architecture diagrams and infrastructure-as-code definitions; integrates into the SDLC and is available in cloud and on-premise deployments for enterprise customers.
- Jeff AI AI assistant that generates threat modeling diagrams from text prompts or image uploads, provides AI Smart Views for tailored outputs, and enables users to scale security efforts using AI.
- Bex AI - Conversational Security in Jira Conversational AI security assistant embedded in Jira that automatically assesses and improves the security of software directly within the development workflow.
- IriusRisk Community Edition Free-forever community edition of the IriusRisk platform providing access to threat modeling tools and libraries for individual practitioners and small teams at no cost.
- IriusRisk Professional Services Tailored professional services including threat modeling training, implementation support, and consulting delivered alongside the IriusRisk platform.
Quantifiable outcome
- 203% ROI with payback within 6 months (Forrester TEI study)
- +5 more outcomes
Companies that use IriusRisk
Customer profileNamed customers12 records
Segments8 records
Ideal customer profiles5 records
IriusRisk technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration8 records
AI capability6 records
Feature8 records
IriusRisk partnerships and signals
Strategic signalPartnerships
Ten partnerships are on record, tiered core and flagship.
- ThreatModelercoreThreatModeler acquired IriusRisk for $100 million in January 2026, combining the two leading enterprise threat modeling platforms. The merged organization is majority owned by Invictus Growth Partners.
- European Cybersecurity Competence Centre (ECCC)flagshipECCC is co-funding the free community edition of IriusRisk to advance the solution and increase the number of people creating secure-by-design software in Europe.
- ISA Security Compliance Institute (ISCI)coreIriusRisk is a technical member of the ISA Security Compliance Institute, actively contributing to the ISASecure Cybersecurity Conformance Scheme and IEC/ANSI 62443 standards development.
- ToreoncoreTraining partner providing threat modeling training to effectively scale customer threat modeling programs.
- Shostack + AssociatescoreTraining partner founded by Adam Shostack, a threat modeling pioneer, providing Threat Modeling Training and The Accelerator Program.
- MITRE CorporationcoreFramework integration partnerships for MITRE ATT&CK (Enterprise, ICS, Mobile matrices) and EMB3D threat modeling frameworks for embedded devices.
- AWScoreIntegration with AWS CloudFormation for automated threat modeling from AWS infrastructure definitions.
- HashiCorpcoreIntegration with HashiCorp Terraform for automated threat modeling from Terraform infrastructure code.
- MicrosoftcoreIntegration with Microsoft Visio and Microsoft Threat Modeling Tool for diagram import and threat model generation.
- LucidchartcoreIntegration with Lucidchart for automated threat modeling from diagram imports.
Scale indicators12 records
Recent moves6 records
Expansion highlights6 records
IriusRisk competitors and assessment
Company assessmentEmerging players
- ForAllSecure: ForAllSecure applies automated reasoning and fuzzing to application security, representing an emerging approach to design- and runtime-phase vulnerability detection that partially overlaps with IriusRisk's automated analysis positioning.
- OWASP Threat Dragon: OWASP Threat Dragon is an open-source threat modeling tool following STRIDE and similar methodologies, serving as a free alternative for organizations unwilling to pay for commercial platforms like IriusRisk.
Broad incumbents
- Snyk: Snyk is a broader developer security platform expanding from SCA/SAST into design-phase security and cloud posture. Its roadmap intersects with IriusRisk as it incrementally adds threat modeling-adjacent capabilities to its AppSec portfolio.
- Cybereason: Cybereason is a broader endpoint detection and response and threat intelligence platform that touches threat analysis workflows, representing an adjacent incumbent that may expand into design-phase threat modeling.
- Veracode: Veracode is a broad application security platform offering SAST, DAST, and software composition analysis. It represents the incumbent AppSec vendor that may bundle design-phase threat analysis into its platform, competing with IriusRisk's standalone positioning.
- Plexicus (Cisco Secure Application): Plexicus, now part of Cisco, provides application security posture management integrated into Cisco's broader security portfolio, representing an incumbent that competes for the same AppSec and threat modeling budget that IriusRisk targets.
- Checkmarx: Checkmarx offers an enterprise application security platform that increasingly covers the full SDLC. As Checkmarx expands into design-phase capabilities, it overlaps with IriusRisk's secure-by-design value proposition.
Direct peers
- ThreatModeler: ThreatModeler is IriusRisk's most direct competitor in automated enterprise threat modeling, offering a platform for threat modeling across the SDLC. The two companies are now combined following ThreatModeler's $100M acquisition of IriusRisk in January 2026.
- Microsoft Threat Modeling Tool: Microsoft's free Threat Modeling Tool is a baseline direct competitor used widely by enterprises for STRIDE-based design-phase threat analysis. Its bundling with the Microsoft ecosystem pressures IriusRisk's pricing and adoption.
- Security Compass: Security Compass offers SD Elements, a threat modeling and secure-by-design platform comparable to IriusRisk, targeting financial services and regulated enterprises with compliance-driven secure development workflows.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
IriusRisk social profiles
Digital presenceIriusRisk compliance and trust
Trust signalCompliance1 record
IriusRisk financial estimates
Financial estimateRevenue estimate
Valuation estimate
IriusRisk leadership team
Management profileNumber of profiles
Profiles10 records
IriusRisk funding detail
Funding detailFunding overview
Funding rounds3 records
Investors6 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
IriusRisk M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about IriusRisk
What does IriusRisk do?
IriusRisk sells an automated threat modeling platform that uses a rules engine to generate threat models, threats, and countermeasures from architecture diagrams and infrastructure-as-code definitions. The platform integrates into the software development lifecycle and is supplemented by Jeff AI for AI-assisted diagram creation, Bex AI for in-Jira security assessment, a community edition, and tailored professional services.
Is IriusRisk a public or private company?
IriusRisk is a private company. It is classified as private equity controlled and is currently acquired.
When was IriusRisk founded?
IriusRisk was founded in 2015. It employs 101 to 250 people.
Where is IriusRisk based?
IriusRisk is headquartered in Huesca, Spain, in the Europe region.
How does IriusRisk make money?
Three revenue lines are on record. Software Subscription is the primary driver. The others are professional Services and free Community Edition.
Who are IriusRisk's main competitors?
Emerging players on record are ForAllSecure and OWASP Threat Dragon. Broad incumbents are Snyk, Cybereason, Veracode, Plexicus (Cisco Secure Application) and Checkmarx. Direct peers are ThreatModeler, Microsoft Threat Modeling Tool and Security Compass.
Does IriusRisk have an API?
Yes. IriusRisk provides an API that allows organizations to integrate their existing security testing tools into the platform. The API enables custom risk libraries and integration with security testing workflows. The platform supports bidirectional integration with engineering and DevOpSec workflows, projects, and issue tracking systems. Developer documentation is at www.iriusrisk.com/documentation/introduction.
What industry is IriusRisk in?
IriusRisk's product category is Application Security Software. Its primary akta.pro industry code is HDAEANAE, Enterprise AI Governance, Risk & Compliance Platforms (Model Risk, Audit, Policies), with a secondary code of HDAAAKAA, Model Governance, Risk & Compliance (GRC) Platforms. Its NAICS code is 5132 and its SIC code is 7372.