ThreadFix was one of the original application vulnerability management platforms. Coalfire discontinued the ThreadFix SaaS platform in 2025, so the active product is no longer available for new customers.
This page is kept as a historical reference for teams evaluating what ThreadFix did and where to look next.
ThreadFix alternatives (active in 2026)
Since ThreadFix is discontinued, teams that need its aggregation-plus-prioritization pattern have three strong replacements to choose from:
- ArmorCode — 320+ tool integrations, the widest native connector library of any ASPM platform. Closest drop-in for ThreadFix users who valued the centralized correlation dashboard.
- DefectDojo — free and open-source, self-hosted, with a similar data-model philosophy (findings, engagements, products). Best fit for teams with the operations capacity to run their own instance.
- Software Risk Manager (Black Duck, formerly Code Dx) — 150+ tool integrations, commercial-grade correlation, strong in regulated industries where compliance reporting is a gating requirement.
For a broader shortlist, the ASPM tools category page compares every active platform in this space.
What is ThreadFix?
ThreadFix was created by Denim Group and has been a staple in the application security industry for over a decade.
It provides a centralized platform for managing vulnerability data from various security testing tools.
The platform was acquired by Coalfire, a cybersecurity consulting firm.
ThreadFix 3.1 introduced a complete architectural overhaul with Kubernetes-managed microservices, resulting in 10x+ ingestion speed improvements and horizontal scaling capabilities.
Key Features
Vulnerability Aggregation
ThreadFix imports results from numerous security tools:
- SAST - Fortify, Checkmarx, Veracode, SonarQube
- DAST - Burp Suite, OWASP ZAP, Qualys WAS
- SCA - OWASP Dependency-Check, Snyk, Black Duck
- Penetration Testing - Manual findings import
Risk-Based Prioritization
ThreadFix calculates risk scores based on:
- Vulnerability severity (CVSS)
- Application criticality
- Exposure and exploitability
- Business context
Defect Tracker Integration
Seamless integration with issue trackers:
- Jira
- Azure DevOps
- Bugzilla
- GitHub Issues
Vulnerabilities can be automatically pushed to development teams.
How It Works
Security Tools → ThreadFix → Prioritized Findings → Defect Tracker
↑ ↓
└──────────── Remediation Feedback ──────────────────┘
ThreadFix provides a feedback loop for tracking remediation progress.
Architecture
ThreadFix 3.1 runs as microservices in a Kubernetes-managed container cluster.
Key architectural improvements:
- Horizontal scaling with configurable processing services
- Rewritten ingestion and merge logic for faster processing
- Container-based deployment for cloud or on-premises environments
Deployment options include SaaS (managed by Coalfire) and self-hosted enterprise installations for air-gapped environments.
Key Capabilities
Vulnerability Correlation
ThreadFix correlates findings across tools:
| Source | Finding | Location |
|---|---|---|
| SAST Tool A | SQL Injection | users.java:142 |
| SAST Tool B | Query Flaw | users.java:142 |
| DAST Scanner | SQLi | /api/users |
All three findings are correlated as a single vulnerability.
Trend Analytics
Track security posture over time:
- New vs. closed vulnerabilities
- Mean time to remediation
- Team performance metrics
- Compliance status
API Access
ThreadFix provides a comprehensive REST API:
# Example: Get vulnerabilities
curl -X GET "https://threadfix.example.com/rest/latest/applications/1/vulnerabilities" \
-H "Authorization: APIKEY abc123"
Integration
ThreadFix integrates across the security and development lifecycle:
| Category | Integrations |
|---|---|
| Scanning | SAST, DAST, SCA, threat modeling tools |
| Issue Tracking | Jira, Azure DevOps, Bugzilla, GitHub Issues |
| GRC | Compliance and risk management platforms |
| CI/CD | Jenkins, GitHub Actions, GitLab CI |
CI/CD Example
# GitHub Actions
- name: Upload to ThreadFix
run: |
curl -X POST "$THREADFIX_URL/rest/latest/applications/$APP_ID/upload" \
-H "Authorization: APIKEY $API_KEY" \
-F "file=@scan-results.xml"
When to Use ThreadFix
ThreadFix fits organizations with multiple security testing tools that need centralized vulnerability tracking, defect tracker integration, and remediation metrics.
The Kubernetes-based architecture handles high-volume environments efficiently.
