Lantern

Community preview

Security starts before the first commit

Lantern is a threat modeling tool for teams building secure systems.

Launch now Watch demo

Keep your entire security model consistent and up to date

Lantern stores your security design as a single structured project graph. Assets, system elements, threats, mitigations, assessments, and diagrams all draw from the same source of truth, so changes stay consistent across the entire project.

Reuse system elements across multiple diagrams
Threats and controls linked to system elements
Trace assets through processes, stores, and flows
Track assessment status across the project

Break complex systems down into clear diagrams without any manual layout work

Describe the system, its components, and the flows between them. Lantern handles the drawing and layout automatically, from high-level overviews to focused views of individual features, services, processes, or workflows.

Quickly create focused views for specific areas
Build multiple diagrams from shared project data
Layout and drawing is fully automated
Step through ordered flows interactively

Manage threats and risks all the way from discovery to resolution

Identify and assess threats in the context of the system. Link them to affected elements, calculate risk from likelihood and impact, and track their treatment over time.

Build on a maintained library of known threats
Link threats to affected system elements
Track threat and mitigation status
Detect when changes require reassessment

Offline first

Work fully offline in the browser. Optional online capabilities will never replace full offline support.

AI supported, but optional

Use AI when it helps, while retaining full control over whether and how project data is exposed.

Full portability

Store and exchange the complete security model as structured JSON, without proprietary lock-in.

Project insights

See what has been covered, which threats remain open, and where follow-up is still needed.

Shareable reports

Create downloadable reports for reviews, presentations, releases, and follow-up.

Threat suggestions

Use element metadata and established weakness catalogs to find threats that may apply.

FAQ

Does Lantern do AI?

No. And also yes.

I see a lot of value in AI. I just don't think every tool needs a built-in model and AI buttons everywhere.

Lantern takes a slightly different approach (for now). Instead of tying you to a specific provider or workflow, it lets you decide whether to use AI at all, which model to use, and where your data is sent.

Projects can be exported as JSON together with a JSON Schema that describes the expected structure. You can provide both to any AI model along with your own instructions, generate content, and import the result back into Lantern.

A built-in AI model may be more convenient, but for technical users, the added freedom, transparency, and control are worth the extra step.

What methodologies are supported?

test

Why aren't diagrams the source of truth?

Diagrams are optimized for communication. Security models are optimized for analysis. Lantern separates the two so you can create multiple diagrams from the same underlying model without duplicating information.

Where is my data stored?

Threat models often contain sensitive information about your systems, architecture, and security controls. You should always know where that data is stored.

You can use Lantern in three ways:

Offline: Your threat models remain in your browser's local storage and are never uploaded anywhere.
Cloud: Projects are securely stored on Lantern's servers to support collaboration across your team. You can export the full data model at any time.
On-premises: All project data is stored within your own infrastructure.

Is Lantern production ready?

That is up to you. The tool is, in its current form, being evluated in five pilot projects at Fortune 500 companies.

It is not perfect. The list of things to implement is longer than the list of things that have been implemented.

Having that said it is being actively worked on.

Can I export my data?

Yes. The entire model can be exported.