HashGo · Threat modeling
HashGo Threat Modeling
Live
HashGo Threat Modeling draws your system from code, cloud and design documents, finds the threats your architecture creates, shows the attack paths to your crown jewels, and puts a price on each risk. It updates itself on every pull request.
Internal measurements, October 2026: five open-source repositories took 3 to 37 seconds from connection to first model, with AI review switched off. Precision and recall from customer pilots will be published here.
Product tour
What your team sees after sign-in: a model that drew itself, the threats it implies, and the paths and money behind each one. Click any screen to enlarge it.
Screens from the live platform with sample data from a fictional company. Loss figures use editable FAIR assumptions; your own model uses your revenue, asset values and risk appetite.
Why not use the free tools?
Free tools draw diagrams and list generic threats. HashGo builds and maintains the model for you and tells you what each risk costs.
| Microsoft Threat Modeling Tool | OWASP Threat Dragon | HashGo Threat Modeling | |
|---|---|---|---|
| Who draws the model | You, by hand | You, by hand | AI agents from code, cloud and documents; you review |
| Stays current | Manual redraw | Manual redraw | Updates on every pull request and cloud change |
| AI and agent threats | No | Limited | OWASP LLM and Agentic Top 10, MAESTRO, ATLAS |
| Attack paths | No | No | Paths to crown jewels for four attacker profiles |
| Risk in money | No | No | FAIR loss estimates and best remediation budget |
| Developer workflow | Desktop app | Desktop / web app | PR gate, CLI, VS Code, MCP server, ticket sync |
| Compliance mapping | No | No | ISO 27001, PCI DSS, SOC 2, DORA, NIS2 and more |
| Import existing models | n/a | n/a | Yes, from both tools and OTM |
Keep your existing models: import them from Microsoft TMT or Threat Dragon in one click.
Capabilities
From a blank page to a reviewed, quantified model in minutes, kept current on every pull request.
Agents read what you already have, and show where each fact came from.
Threats that follow from your architecture, each with the reason it applies.
LLM apps, RAG pipelines, agents and MCP servers modelled as first-class components.
Know which threats chain into a breach, and what it would cost.
The model changes when the system does, and gates the changes that add risk.
Every claim the system makes can be checked, corrected and scored.
How it works
Point it at a repository or cloud account, upload documents, or describe a feature in plain language.
The model is drawn, threats are found and checked, and paths and loss are computed.
Confirm what the agents were unsure about, accept or treat risks, and send work to your tracker.
Every pull request and cloud change updates the model and is gated by your policies.
Coverage
Data handling
How the hosted service treats your models, code and documents.
The hosted service runs in India (Mumbai). Connections use TLS, and API keys and integration credentials are encrypted in the database.
AI steps send only the text they need to the model provider configured for your plan. Rule-based analysis, attack paths, risk figures and gates run without AI. On Enterprise, use your own key or a private model.
Read-only access to repositories and cloud accounts. We never change your code or infrastructure; we only post pull-request comments and update the tickets you connect.
Shared cloud, or on Enterprise a dedicated single-tenant service or an installation inside your own network.
Uploaded source archives are deleted once discovery finishes unless you choose to keep them. Delete a model at any time, and export everything in Open Threat Model (OTM) format.
Every human, agent and API action is written to a tamper-evident, hash-chained audit log. Security questions: info@threatxintel.com.
Threat modeling and the HashGo suite
Threat Modeling decides what could go wrong. SAST checks the code that was written. GRC proves the controls are in place.
| HashGo Threat Modeling | HashGo SAST | HashGo GRC | |
|---|---|---|---|
| What it examines | The architecture: components, data flows, trust boundaries | Source code, without running it | Controls, policies and evidence |
| When it runs | At design time and on every change | On pull requests and in CI | Continuously, against your frameworks |
| Typical output | Threats, attack paths, required controls, loss estimates | Vulnerabilities proven at the exact line | Compliance status and audit evidence |
| Works before code exists | Yes | No | Yes |
Pricing
Published prices, a free plan for evaluation, and AI included on every plan.
Prices are per organization per month, billed yearly.
Evaluation and small teams
₹0
$0
Product and platform teams
₹15,000/month
$199/month
Security programmes across many systems
₹45,000/month
$599/month
Banks, insurers, groups and the public sector
From ₹15 lakh/year
From $25,000/year
| Feature | Free | Team | Business | Enterprise |
|---|---|---|---|---|
| Modelling | ||||
| AI model building from code, IaC, API specs and design documents | Included | Included | Included | Included |
| Import from Microsoft Threat Modeling Tool, OWASP Threat Dragon and Open Threat Model | Included | Included | Included | Included |
| Visual editor, templates, versions and branches | Included | Included | Included | Included |
| Modelled systems | 3 | 10 | 50 | Unlimited |
| Users | 3 | Unlimited | Unlimited | Unlimited |
| Self-service intake for product teams | Not included | Included | Included | Included |
| Live cloud discovery (AWS, Azure, Google Cloud) and Kubernetes | Not included | Included | Included | Included |
| Analysis | ||||
| STRIDE threats, each with the reason it applies | Included | Included | Included | Included |
| All methods: LINDDUN, PASTA, MITRE ATT&CK, OWASP | Not included | Included | Included | Included |
| AI and agent threats: OWASP LLM and Agentic Top 10, MAESTRO, MITRE ATLAS | Not included | Included | Included | Included |
| Attack paths, choke points and what-if simulation | Not included | Included | Included | Included |
| Risk in money: FAIR loss estimates and best remediation budget | Not included | Not included | Included | Included |
| Compliance mapping: ISO 27001, PCI DSS, SOC 2, DORA, NIS2; AI governance | Not included | Not included | Included | Included |
| Custom threat libraries and methodologies | Not included | Not included | Not included | Included |
| Developer workflow | ||||
| Pull-request gate, CLI and VS Code | Not included | Included | Included | Included |
| Jira, GitHub and GitLab sync | Not included | Included | Included | Included |
| MCP server for AI coding assistants | Not included | Not included | Included | Included |
| ServiceNow and Azure Boards | Not included | Not included | Included | Included |
| Full REST API | Not included | Not included | Included | Included |
| AI | ||||
| AI agents included (full analyses per system per month) | 5 | 5 | 5 | Contracted |
| Bring your own AI key or a private model | Not included | Not included | Not included | Included |
| Security and deployment | ||||
| Tamper-evident audit log | Not included | Not included | Included | Included |
| Single sign-on (OIDC) and SCIM provisioning | Not included | Not included | Included | Included |
| Single-tenant or on-premises; regional hosting | Not included | Not included | Not included | Included |
| Support | Community | Email, next business day | Priority, business hours IST / GST | Named manager and SLA |
AI usage
Eighteen agents take part in a full analysis. The allowance below keeps costs predictable; rule-based analysis never stops.
| Plan | AI allowance | When the allowance is used up |
|---|---|---|
| Free, Team and Business | 5 full AI analyses per system per month: an analysis, a discovery run, a self-service intake or a diagram import | Rule-based analysis, attack paths, risk figures and gates keep running; the allowance resets on the 1st |
| Pull-request checks | Incremental and rule-based, so they do not count | Not affected |
| Enterprise | Bring your own key (Anthropic, Amazon Bedrock, Google Vertex AI) or a private model | No allowance; your provider bills you directly |
Add-ons and services
| Add-on | India (INR) | International (USD) |
|---|---|---|
| Extra system on Team | ₹1,800 / month | $25 / month |
| Extra system on Business | ₹1,100 / month | $15 / month |
| Expert-led threat modeling workshop (per system) | ₹75,000 | $1,000 |
| Architecture security review by ThreatXIntel | Quoted | Quoted |
| HashGo suite bundle: Threat Modeling with SAST or GRC | 20% off | 20% off |
| Term | Detail |
|---|---|
| Launch offer | 30% off the first year for the first 20 customers |
| Billing cycle | Yearly in advance by default; monthly available at +20% |
| Adding systems | Extra systems are billed pro rata for the rest of the term |
| Payment in India | Bank transfer, UPI or card, with a GST tax invoice |
| International payment | Wire transfer or card in USD |
| Enterprise payment terms | Net 30 days from invoice |
| Billing entity | Threatxintel Cyber Labs LLP, Bengaluru, India |
Prices are valid from 10 October 2026 and may change with notice. Existing customers keep their price until renewal.
No. You can start from a design document, a diagram or a plain-language description. Code and cloud access make the model more accurate.
No. It does the drafting and keeps the model current; your team reviews what the agents were unsure about and makes the risk decisions.
Yes. Pull requests that add unacceptable risk can fail the build through policy-as-code, with SARIF results in GitHub, GitLab or Azure DevOps.
Every threat shows why it applies and how confident the agents are, and anything uncertain goes to a review queue. Every release is checked against a labelled benchmark of 24 reference systems; precision and recall measured in customer pilots will be published on this page.
In our internal test of five open-source repositories, the median was 5 seconds from connecting the repository to the first model, and the largest took 37 seconds. AI review runs after the first model is drafted.
Free for up to 3 systems; paid plans from ₹15,000 / $199 a month. See pricing.
Yes. Threat Modeling says what could go wrong in the design; SAST proves what is actually exploitable in the code; findings link to the same threats.
The hosted service runs in India (Mumbai). Enterprise customers can choose a dedicated single-tenant service or an installation inside their own network. See data handling.
Rule-based analysis, attack paths, risk figures and the pull-request gate keep working. AI steps resume when the allowance resets on the 1st of the month.
Connect a repository or describe a system, and see its threats, attack paths and risk in minutes.
