# CAPEC

CAPEC is a Threat Modeling product. It runs in the cloud. Pricing is free.

CAPEC™ is a comprehensive dictionary of known attack patterns used by adversaries to exploit weaknesses in cyber-enabled capabilities.

Checked October 2026.

## What is CAPEC?

Common Attack Pattern Enumeration and Classification (CAPEC™) is a community resource that provides a comprehensive dictionary of known patterns of attack employed by adversaries to exploit weaknesses in cyber-enabled capabilities. It helps analysts, developers, testers, and educators enhance defenses by advancing community understanding of how adversaries operate.

Tags: Cyber Threat Intelligence

## Where it fits in your security program (NIST CSF 2.0)

- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [Threat Modeling](https://cybersectools.com/categories/threat-modeling)
- Deployment: Cloud
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- Website: capec.mitre.org

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best Application Security Solutions for Business](https://cybersectools.com/shortlists/best-application-security-solutions).

## CAPEC FAQ

### What is CAPEC?

CAPEC is a product in the Threat Modeling category. It covers Cyber Threat Intelligence.

### What is the pricing for CAPEC?

CAPEC is free. Download and setup instructions are at https://capec.mitre.org/.

### What are alternatives to CAPEC?

Alternatives to CAPEC listed on CybersecTools:

1. [Heeler Runtime Threat Modeling](https://cybersectools.com/tools/heeler-runtime-threat-modeling) - AI-powered continuous threat modeling for cloud applications in runtime (Commercial)
2. [Avertro Threat Modeling and Simulation](https://cybersectools.com/tools/avertro-threat-modeling-and-simulation) - AI-driven threat modeling & simulation platform using MITRE ATT&CK framework (Commercial)
3. [Seezo Security Design Reviews and Threat Modeling](https://cybersectools.com/tools/seezo-security-design-reviews) - Automated security design review platform for developers (Commercial)
4. [Apiiro AI-Powered Risk Detection](https://cybersectools.com/tools/apiiro-ai-powered-risk-detection) - AI-powered pre-development risk detection for secure-by-design software (Commercial)
5. [GrammaTech ConfINE](https://cybersectools.com/tools/grammatech-confine) - Framework for modeling access control and attack graphs in networked systems (Commercial)

Compare all CAPEC alternatives at [https://cybersectools.com/alternatives/capec](https://cybersectools.com/alternatives/capec)

### What deployment and organization size does CAPEC fit?

CAPEC is available as cloud. It is listed for startup, smb, mid-market and enterprise organizations. It is free.

## Compare CAPEC with similar solutions

- [CAPEC vs Heeler Runtime Threat Modeling](https://cybersectools.com/compare/capec-vs-heeler-runtime-threat-modeling)
- [CAPEC vs Avertro Threat Modeling and Simulation](https://cybersectools.com/compare/avertro-threat-modeling-and-simulation-vs-capec)
- [CAPEC vs Seezo Security Design Reviews and Threat Modeling](https://cybersectools.com/compare/capec-vs-seezo-security-design-reviews)

All alternatives to CAPEC: [/alternatives/capec](https://cybersectools.com/alternatives/capec)

---

Source: https://cybersectools.com/tools/capec

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on CAPEC: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md