OSI-licensed open source

Best Open-Source Risk Management Software (2026)

Risk management software helps teams identify, score and track risks, whether those are information security risks, application vulnerabilities, architecture threats or financial exposures. Open-source options let you adopt GRC-style workflows without per-seat licensing and keep sensitive risk data in your own environment.

This page covers verified OSI-licensed projects across several risk domains: governance and compliance (CISO Assistant), risk analysis methods (MONARC), vulnerability tracking (DefectDojo), threat modelling (OWASP Threat Dragon, Threagile) and quantitative financial risk (Open Source Risk Engine). Pick by the kind of risk you manage rather than expecting one tool to cover all of them.

Tools, licences and pricing checked against vendor and repository pages on November 7, 2026.

What to look for

  • •Risk domain: security GRC, application security, threat modelling or financial
  • •Framework and standards coverage such as ISO 27001
  • •Workflow: risk registers, scoring, treatment and reporting
  • •Integration with CI/CD and scanners
  • •Self-hosting effort and database requirements
  • •Licence and any enterprise-only features

At a glance

ToolBest forPricingLicence
CISO AssistantSecurity GRC with framework mappingFree, open source (Community); enterprise edition, See vendor pricingAGPL-3.0
MONARCInformation security risk assessmentsFree, open sourceAGPL-3.0-only
DefectDojoApplication vulnerability and risk trackingFree, open source; commercial Pro, See vendor pricingBSD-3-Clause
OWASP Threat DragonThreat modelling during designFree, open sourceApache-2.0
ThreagileAgile threat modelling as codeFree, open sourceMIT
Open Source Risk Engine (ORE)Quantitative financial risk analyticsFree, open sourceBSD-3-Clause

1. CISO Assistant

AGPL-3.0

Best for: Security GRC with framework mapping · Free, open source (Community); enterprise edition, See vendor pricing

CISO Assistant is an open-source platform for governance, risk and compliance covering risk management, audit and third-party risk. It supports many security and compliance frameworks and provides automatic control mapping.

Strengths

  • + Broad framework library
  • + Active development

Trade-offs

  • − Enterprise directory is under a commercial licence
WebsiteRepository

2. MONARC

AGPL-3.0-only

Best for: Information security risk assessments · Free, open source

MONARC is an optimised risk analysis method developed by CASES that reuses risk scenarios across organisations. Its application includes a RESTful API with Docker and Vagrant setups.

Strengths

  • + Structured, repeatable method
  • + Reusable scenarios

Trade-offs

  • − Narrower than a full GRC suite
WebsiteRepository

3. DefectDojo

BSD-3-Clause

Best for: Application vulnerability and risk tracking · Free, open source; commercial Pro, See vendor pricing

DefectDojo is an open-source DevSecOps and application security posture management tool that coordinates security testing and tracks vulnerabilities through deduplication, remediation and reporting.

Strengths

  • + Aggregates many scanner outputs
  • + Deduplication and reporting

Trade-offs

  • − Focused on AppSec rather than enterprise risk
WebsiteRepository

4. OWASP Threat Dragon

Apache-2.0

Best for: Threat modelling during design · Free, open source

OWASP Threat Dragon is a free open-source application for drawing threat model diagrams and listing threats per element. It runs as a web app connected to GitHub, Bitbucket or GitLab and has desktop installers.

Strengths

  • + Visual diagrams with threat lists
  • + Desktop and web versions

Trade-offs

  • − Manual process without automated rule checks
WebsiteRepository

5. Threagile

MIT

Best for: Agile threat modelling as code · Free, open source

Threagile lets teams describe an architecture in a YAML model and checks it against built-in and custom risk rules. It runs from Docker, as a CLI or as a REST API server.

Strengths

  • + Model-as-code fits CI
  • + Custom risk rules

Trade-offs

  • − Requires YAML modelling effort
WebsiteRepository

6. Open Source Risk Engine (ORE)

BSD-3-Clause

Best for: Quantitative financial risk analytics · Free, open source

ORE is an open-source framework for pricing and risk analytics, including XVAs, built on QuantLib. It adds simulation models, instruments and pricing engines.

Strengths

  • + Established quant framework
  • + Extends QuantLib

Trade-offs

  • − Financial risk only, not security or compliance
WebsiteRepository

New tools in this space, weekly

One email a week with the tools, launches and releases added to TechLogHub. Unsubscribe in one click.

Get the TechLogHub digest

One email a week: new and trending developer tools, fresh comparisons, and what shipped. Unsubscribe in one click.

How to choose

If you need…Start with
Security GRC with compliance frameworksCISO Assistant
Structured information security risk analysisMONARC
Track application vulnerabilitiesDefectDojo
Threat modelling in designOWASP Threat Dragon, Threagile
Financial risk analyticsOpen Source Risk Engine (ORE)

Best Open-Source Risk Management Software: FAQ

Quick answers to common questions

What is open-source risk management software?

Software under an OSI licence that supports identifying, scoring and tracking risks, from security GRC to threat modelling and financial analytics.

Which tool is closest to a full GRC suite?

CISO Assistant is the closest in this list, covering risk, audit and compliance workflows.

Is SimpleRisk included?

SimpleRisk's repository page did not state a licence when we checked, so it is not listed. Check its licence yourself before adopting.

Can I use these tools for ISO 27001?

CISO Assistant and MONARC support ISO 27001-style work; always confirm framework coverage in the project's documentation.

Related categories

Open-Source Compliance Management Software and ToolsOpen-Source Audit Management and Auditing ToolsVulnerability Management Software ComparedBest Open-Source Software Security ToolsData Privacy Software for Compliance Teams

Building a tool in this category?

List it on TechLogHub and we'll review it for this guide.

Submit a tool