Enterprise DNA

Instead of IriusRisk

Stop renting IriusRisk. Own your design review system.

We build your version around how your team reviews software risks, bring your IriusRisk records across and run the system for you. Your people keep control of the assessments and decisions.

IriusRisk Enterprise pricing is quoted for the model capacity you need, with unlimited users. Compare that renewal with a system your business owns.

Get your version built See it working
  • check_circleYour data in a database you own
  • check_circleOpen source, no lock-in
  • check_circleBuilt and run by Enterprise DNA

The IriusRisk bill

Your renewal buys a managed modelling platform

IriusRisk provides more than a risk list. Decide which parts your team needs, then build your own review workflow around the records and evidence you already maintain.

layers

Capacity for active models

Enterprise licensing is based on the threat models you need. Community offers a free starting point for an individual, while Enterprise supports a larger programme.

users

Team participation

Enterprise includes unlimited users. The comparison is about model capacity and the platform you rely on, not an invented charge for every reviewer.

shield

Threat and countermeasure content

The platform supplies libraries and configuration options. Your own version starts with the risks your team records and the safeguards it can verify.

git-branch

Interactive design diagrams

IriusRisk provides diagramming and imports from other diagram tools. Your owned version keeps a readable register of components, information flows and trust boundaries.

file-text

Exports and reports

Enterprise supports full model exports and reporting. Bring an export across, check its contents and keep the original beside your new working records.

settings

Integration and support

Issue-tracker connections, configuration and onboarding are part of the platform choice. Enterprise DNA scopes those connections around the systems your team actually uses.

Your review workflow

Follow a design risk through to evidence

Design context

See where information changes hands

Keep the scope, responsible person and system boundaries beside the risk assessment.

  • check Record the components and their trust zones
  • check Read each information flow and the data it carries
  • check Find boundary crossings without a recorded threat
  • check Add your internal service references and review rules

Treatment work

Separate a proposed safeguard from a verified one

Owners and dates make the work visible. Evidence determines whether a control is verified.

  • check Prioritise open threats using your recorded assessments
  • check List overdue treatment work with its owner
  • check Keep imported implementation claims unverified until reviewed
  • check Reopen a closed threat when its control verification is invalidated

Decisions

Keep exceptions and reviews current

An old decision should not quietly become permanent approval.

  • check Record who accepted a risk, why and until when
  • check Find exceptions that have expired or expire soon
  • check Invalidate an older acceptance after the threat is reassessed
  • check Show models changed since their last recorded review

Working papers

Prepare the review from the same records

Put the evidence in front of the people who make the decision.

  • check Prepare a model review paper and a treatment plan
  • check Read a branded boundary register without changing records
  • check Draft the weekly review from current risks and controls
  • check Keep the full import and working history in a private export

Make it yours

Design your own IriusRisk replacement

Everything starts from the open-source base. Then it gets your name, the parts you run, your rules and your data from IriusRisk. Try it here, and we build the real one.

2. What it runs

3. Make it fit

4. Your colour

Your business · your IriusRisk replacement Your version
YB Your business

auto_awesome

Answered from your own database

Build my version

We build it from the open-source base, bring your IriusRisk data across and run it for you.

What it looks like

Ask it like you would ask a colleague

Real answers from the demo data that ships with Threat Modelling for Claude Code. It runs in Claude Code inside the Claude app, so it feels like any chat you already use.

forum

Threat Modelling for Claude Code

Connected to your own database

Which threats are still open, and who owns the next action?

DEMO-BATCH

Code
T-EXPORT
Name
Export permission is unclear
Surface
Export worker
Score
unknown
Due_on
unknown
Disposition
open
Controls
0
Unverified
0
Acceptance_expires
unknown

DEMO-PORTAL

Code
T-ACCESS
Name
Another account reads private files
Surface
Portal service
Score
72.0
Owner
Arun Singh
Due_on
2026-11-01
Disposition
open
Controls
1
Unverified
1
Acceptance_expires
unknown

DEMO-PORTAL

Code
T-UPLOAD
Name
Oversized upload exhausts capacity
Surface
Document upload
Score
42.0
Owner
Mira Chen
Due_on
2026-11-07
Disposition
open
Controls
1
Unverified
1
Acceptance_expires
2026-11-04

Ask it anything

Questions IriusRisk cannot answer

Every one of these is a real question the demo answers today. Yours will be different, and that is the point.

chat_bubble Which high-scoring threats still have no verified controls?
chat_bubble Which data movements cross a trust boundary without a recorded threat?
chat_bubble Which models changed after the last recorded review?
chat_bubble Which controls are overdue and who owns them?
chat_bubble Which accepted risks have expired or expire in the next month?
chat_bubble Which imported controls claim implementation but have no local verification?
chat_bubble Which components have no recorded trust zone?
chat_bubble Which threats still lack an owner, a due date or an assessment?
chat_bubble Which review evidence covers the current model revision?
chat_bubble Who changed a risk assessment, and what did they record?

Switching

How to switch from IriusRisk

In practice, the move involves exporting your full models, testing the import, resolving field and rule differences, and checking the new records before you retire IriusRisk.

  1. 1

    Export your full models

    If you have IriusRisk Enterprise, use its documented full-model OTM JSON export, not a diagram-only export. It brings across design elements and referenced threats and safeguards where present. If that export is not available in your account, ask IriusRisk what record export your plan allows, usually CSV or Excel, and confirm whether it contains the records you need before moving on.

  2. 2

    Test and load the records

    Use the import's preview or dry run on the OTM JSON before loading live records. Then load the export into the database used by your Claude Code workflow. The import keeps the full original JSON and extra attributes, giving you a reference for records that do not map directly. Do not treat the preview as proof that the models are ready to use.

  3. 3

    Review import flags

    Compare imported component, flow and threat counts with the source models, then read every warning or unresolved item from the import. Check fields that need mapping to your own structure and rules. Imported threats stay open, and controls marked implemented remain unverified until your team records local verification evidence. Resolve the differences you need for live reviews before declaring the import complete.

  4. 4

    Run both in parallel

    Keep IriusRisk available while your team uses the new database workflow for a short period. Agree which system is authoritative during the overlap, so updates do not split between two copies. Check that the people doing reviews can work with the records, evidence and decisions they need, and that the new access and backup arrangements are in place before you make the change permanent.

  5. 5

    Switch off IriusRisk

    Once the imported counts and key records have been checked, your reviewers are comfortable with the workflow, and access and backups are agreed, make the new database your working record and switch off IriusRisk. Keep a private copy of the export and maintain backups of the database. The database export includes operational records and original import payloads, but no restore command is included.

construction

Where the real effort goes

The export and initial load are only part of the work. The main effort is usually mapping your own fields and review rules, deciding which historical context needs to be carried into working records, and checking imported claims against evidence. The original payload is retained for reference. If Enterprise DNA runs the replacement for you, they handle this mapping and import work as part of the agreed setup.

Not ready for a call?

Get your IriusRisk switch plan by email

We will send you the step-by-step plan for moving your business off IriusRisk, what the move really involves, and how we would do it for you.

One email with your plan. No spam, and you can unsubscribe any time.

Three ways to own it

Do it yourself, have it customised, or have it run for you

Open source

Do it yourself

Free, open source

  1. 1 Clone the repo and run npm install, npm test and npm run demo
  2. 2 Open it in Claude Code, Codex, OpenCode or Cursor and ask for the threat register
  3. 3 Export your IriusRisk project as OTM JSON, preview the import and compare the counts
  4. 4 Keep the database and its backups under your control. Hosting, agent subscriptions and your time are separate costs.
Get it on GitHub

Built around your business

We customise it

One setup fee, then a retainer for ongoing work

  • check Your review stages, owners, evidence requirements and exception rules
  • check Your IriusRisk records mapped across and checked against the source
  • check Your existing work systems connected to the review process
  • check A web front end or a different technology stack when your team needs one
Get your version built

Omni by Enterprise DNA

We run it for you

One setup fee, then a retainer

  • check Installed with access controls and backups agreed with your team
  • check Weekly reviews and overdue treatment lists prepared for your reviewers
  • check Kept working as your systems, people and rules change
  • check Operated through Omni by Enterprise DNA alongside the rest of your business
Book a call with Sam

Questions

Instead of IriusRisk, answered

Does this replace every IriusRisk feature? expand_more

The free version covers the design review records, threat assessments, mitigation work, verification evidence and risk decisions. IriusRisk also provides maintained threat libraries, automatic threat generation and interactive diagrams. We agree the required scope with your reviewers and build the connections and screens your version needs.

Can we bring our existing models across? expand_more

Yes, through the documented full-model export available to IriusRisk Enterprise users. The import brings across design elements and referenced threats and safeguards where present, and keeps the full original. Diagram-only exports are different. We check the export type and counts before a switch, then review fields that need mapping.

Will an imported completed control be treated as verified? expand_more

No. Imported implementation claims remain unverified until your team records evidence. Risk acceptance needs a named decision-maker, a reason, evidence and an expiry. A design review records what was considered and which risks remain open. It does not certify that your system is secure.

Is the free version free to operate? expand_more

The software has no licence charge. Hosting, backups, agent subscriptions and your team's time are separate. If you want Enterprise DNA to customise and operate it, the arrangement is one setup fee followed by a retainer, with the scope agreed before work starts.

Who can see our sensitive system designs? expand_more

The free version is for a trusted operator with access to its database. Reports and exports stay private. For a team deployment, we agree access controls, hosting, backups and who may record each decision before importing live designs.

Bring the renewal and one design review to Sam

In a 30-minute call, show Sam how your team records risks, verifies safeguards and reviews exceptions. Work out what your own version must retain, what needs connecting and who will run it.

Book a 30-minute call with Sam Get the free version

Threat Modelling for Claude Code is free and open source, published by Enterprise DNA.

Done paying for IriusRisk?

Get your version built