ThreatModeler vs Zeron (2026)

Integrations cover ticketing, diagram and enterprise architecture import, CI/CD and cloud, and the ThreatModeler MCP Server brings threat modeling into AI assistants, GitHub and IDEs. The MCP Server works with ChatGPT and Claude, with editors such as Cursor, VS Code with Copilot and Windsurf, and with CI/CD systems including GitHub Actions, GitLab CI, Azure DevOps and Jenkins.

SourceThreatModeler, threatmodeler.ai/platform and /why-threatmodeler/developersread 2026-10-05

1,300+ integrations span EDR, SIEM, cloud, identity, ITSM and vendor APIs, with ZAK agents acting on the stack, for example patching an endpoint through the CrowdStrike API and updating a Jira ticket after a Slack approval. The live agents act on EDR, XDR, SIEM, CSPM, CNAPP, IAM, PAM, SOAR, GRC, vulnerability management and CMDB tools. The platform normalizes about 7.3 million events a day into the OCSF schema and removes 68% of duplicates across tools.

SourceZeron, zeron.one and /platformread 2026-10-05

Three agents hand work along under a deterministic framework. The System Mapping Agent turns documents and diagrams into models, the Graph Agent enriches the Secure Design Graph with components and threats, and the Reporting Agent produces audit ready reports. System mapping also reads infrastructure as code and cloud context. The Graph Agent adds the controls and patterns specific to the customer's business, and the Reporting Agent writes business reports from the same governed data that produced the model.

SourceThreatModeler, threatmodeler.ai/platformread 2026-10-05

Agent Builder is a visual workflow editor where teams drag triggers, compose actions and ship governed AI agents in minutes, and engineers can build agents in code with the open source ZAK kit. Either way, the customer designs the flow. Each agent runs a five step loop, observe, reason, decide, act and verify, with policy gates at every stage. In code, an engineer writes the agent's logic and tools, and the platform layer handles policy, audit and saving results to the graph.

SourceZeron, zeron.one, /zak and securezeron.github.io ZAK docsread 2026-10-05

Threat modeling runs from the CI/CD pipeline and on diagram and architecture imports, so changes start the work, not a person. Every pull request is checked against the model automatically, with governance applied to each change, in GitHub Actions, GitLab CI, Azure DevOps or Jenkins. When a change opens a risk, the threat and the fix come back in the pull request.

SourceThreatModeler, threatmodeler.ai/platform and /why-threatmodeler/developersread 2026-10-05

Agents subscribe to normalized OCSF events, such as a critical CVE detected or a vendor risk spike, and to schedules, such as a compliance drift check, and they start when one of those arrives. A policy can also fire on a newly created finding, and Agent Builder lets teams drag triggers onto a workflow. Cyber Navigator refreshes value at risk and loss curves whenever telemetry changes.

SourceZeron, zeron.one and /zakread 2026-10-05

The Secure Design Graph is a persistent single source of truth connecting the customer's architectures, components, threats, controls and security decisions, grounded in a curated threat library, and every agent works on it. ThreatModeler calls it a living system of record that changes as the software does. Models follow the STRIDE, PASTA and MAESTRO methods.

SourceThreatModeler, threatmodeler.ai and /platformread 2026-10-05

The Security Intelligence Fabric is a graph database of assets, vulnerabilities, risks and vendors, kept separate for each tenant, that ZAK agents read and write to. Normalized findings are stitched to the asset graph, so the graph keeps up with the customer's estate. The fabric runs on Memgraph, and the platform covers more than 250 compliance frameworks. Cyber Navigator's QBER model blends industry, market cap, business line, locations and regulations with technical findings to estimate annual loss.

SourceZeron, securezeron.github.io ZAK docs and zeron.one/platformread 2026-10-05

The Secure Design Graph, which ThreatModeler says improves every future model, is the platform's knowledge base, not memory the agents keep. The agents keep no memory of their own, with set contents or a set lifetime.

SourceThreatModeler, threatmodeler.ai/platformread 2026-10-05

The graph persistence ZAK handles is the Security Intelligence Fabric, the knowledge graph the agents retrieve from. Zeron describes no memory that agents keep for themselves from one run to the next. Each run names its tenant, and the graph keeps each tenant's nodes in their own namespace.

SourceZeron, securezeron.github.io ZAK docsread 2026-10-05

A deterministic framework governs what the agents produce, so the same architecture gives the same threats and controls. There is no step where a person reviews or approves a generated model before it is saved. When a pull request opens a risk, the threat and the fix go back to the developer in the pull request, in a form a coding assistant can act on.

SourceThreatModeler, threatmodeler.ai/platform and /why-threatmodeler/developersread 2026-10-05

Policies written in Zeron's DSL can require approval before an action, for example "approve: slack('#sec-ops')", alongside hard guardrails and blast radius limits. The agent waits for that approval before it acts. A policy can set conditions on severity, internet exposure or the change in value at risk, and it can forbid an agent from touching assets with a given tag, such as production databases. Policies can be rolled back instantly, and the Action Ledger records the approvals people give.

SourceZeron, zeron.one/zakread 2026-10-05

ThreatModeler Nexus carries ISO 27001:2022 and SOC 2 Type II. It is now FedRAMP Moderate authorized, where it earlier offered FedRAMP Moderate through a partner environment. There is no published SSO, SCIM or role model for the platform. The MCP Server signs clients in with OAuth 2.1.

SourceThreatModeler, threatmodeler.ai and /why-threatmodeler/developersread 2026-10-05

Zeron holds ISO/IEC 27001:2022, ISO/IEC 42001, SOC 2 Type II and CSA STAR Level 1, and the platform provides per tenant isolation, SSO/SAML and RBAC. It also holds ISO 9001:2015. Data is encrypted in transit and at rest, customer data is never used to train models, and the platform is aligned to DPDPA, GDPR and DORA.

SourceZeron, zeron.one/platformread 2026-10-05

Every decision the agents make traces back to the architecture, controls and compliance requirements behind it, with audit ready evidence produced by the Reporting Agent. Every pull request is checked against the model, and reports map to frameworks such as NIST, ISO 27001, PCI DSS, HIPAA, DORA and the EU AI Act.

SourceThreatModeler, threatmodeler.ai/platformread 2026-10-05

The Action Ledger is a tamper evident audit trail mapped to SCF, with every step written to it, so every agent decision can be proven after the fact. It is append only, maps each entry to the customer's control frameworks and includes the approvals people give. Every action on the platform also goes to a tamper evident audit log, and agentctl is built to discover, secure and audit agents across the organization, including agents built on other frameworks.

SourceZeron, zeron.one, /zak and /platformread 2026-10-05

ThreatModeler Nexus is offered as SaaS, on premises or in a private cloud, with regional flexibility.

Sourcethreatmodeler.ai/platformread 2026-09-28

Zeron deploys on premises, in the cloud or as a hybrid. The SaaS option runs on Zeron's cloud on AWS or Azure with in region hosting; Zeron handles setup, and customers work through a browser or the API. The on premises option installs on the customer's own servers, and the customer's IT team handles hardware, software and integration. SaaS can be running within hours or days, and on premises within weeks or months. Zeron does not list its regions, but says data is hosted, processed and stored inside the jurisdiction regulators require.

SourceZeron, zeron.one/deployment and /platformread 2026-10-05

Customers adopt items from a curated library of threats, controls and components into their models. Reports map to more than 180 compliance frameworks, including PCI, NIST, HIPAA and ISO, and three named agents do separate jobs. The product line also includes CloudModeler and ThreatModeler MCP alongside the Nexus platform.

SourceThreatModeler, threatmodeler.airead 2026-10-05

Zeron ships named prebuilt ZAK agents with stated jobs, including Conformity (control evidence for SOC 2, ISO 27001, RBI and SEBI CSCRF; audit companion), Interno (CVE triage that opens tickets; threat hunting), Vendor Pulse (third party reassessment) and Cyber Navigator (CVaR and loss curves). In all, six agents run on the platform.

Threat Hunting works on EDR and SIEM data, Vulnerability Triage on vulnerability management and Jira, Vendor Risk Watcher on GRC, Compliance Evidence on GRC and CMDB, Audit Companion on the Action Ledger and its evidence, and CRQ Refresh on SIEM data. Interno scores and ranks new CVEs before it opens tickets, and the Audit Companion answers auditors' questions in plain language.

SourceZeron, zeron.one and /zakread 2026-10-05

Customers bring their own model, and the platform's agents run on it under the same governance, so the choice of model is the customer's. ThreatModeler does not list which providers it supports. Bring your own model sits among the platform's governance controls, beside the deterministic framework.

SourceThreatModeler, threatmodeler.ai/platformread 2026-10-05

Zeron names no model behind the ZAK agents and offers no choice of provider. The agent definition has a reasoning mode field, which sets how the agent reasons, not which model it uses. Customer data is never used to train models.

SourceZeron, securezeron.github.io ZAK docs and zeron.one/platformread 2026-10-05

The platform has its own MCP Server for AI assistants, GitHub and IDEs. It signs clients in with OAuth 2.1 and works with ChatGPT, Claude, Cursor, VS Code with Copilot and Windsurf, but no endpoint, tool list or API reference is published. When a change opens a risk, the fix comes back in a form a coding assistant can act on.

SourceThreatModeler, threatmodeler.ai/platform and /why-threatmodeler/developersread 2026-10-05

ZAK is an open source agent development kit (github.com/securezeron/zeron-agent-development-kit) installable as zin-adk from pip and npm and as a Go module, with a CLI (zak init, validate, run) and developer docs, and the platform takes REST, GraphQL and webhook connectors. Engineers mark tool functions with a decorator, and the kit's platform layer supplies a policy engine, an audit logger and an agent executor. SaaS customers can also reach the platform through its API.

SourceZeron, securezeron.github.io ZAK docs and zeron.one/deploymentread 2026-10-05

Outputs are deterministic. The same architecture in gives the same threats and controls out, so results repeat. There are no test cases or scores for checking the agents, and no check that a change to the agents or model must pass. Customer results it cites include half the threat modeling effort at Charles Schwab, models built five times faster and ten times as many models produced.

SourceThreatModeler, threatmodeler.ai and /platformread 2026-10-05

Policy Studio offers dry runs and version control before anything ships, and zak validate checks agent definitions. Both check policies and configuration. There is no way to test an agent's behavior against scored cases. The last step of each agent loop is a verify step, where the agent checks what its action did, and policies can be rolled back instantly.

SourceZeron, zeron.one/zak and securezeron.github.io ZAK docsread 2026-10-05

No agent drives a browser, desktop or remote computer. The agents work from design, code and cloud artifacts. They take in documents, diagrams, infrastructure as code and cloud context, and return threats and fixes through reports and pull requests.

SourceThreatModeler, threatmodeler.ai/platform and /why-threatmodeler/developersread 2026-10-05

Agents act through API integrations, and none operates a browser or desktop. They work on EDR, SIEM, GRC, vulnerability management and ticketing tools through those tools' APIs, such as patching an endpoint through the CrowdStrike API.

SourceZeron, zeron.one and /platformread 2026-10-05