03 — 47 resources · 8 roles · checked 2026-10-10

Architect's Toolbox Guide

Pick the job before the tool. Tools, methods and learning resources for eight architecture roles: what each one helps you produce, what to check first, and the sources behind every fact.

LinkedIn X Facebook Email

Tools: Software you install, run in a browser or subscribe to.
Methods and Standards: Frameworks, notations, bodies of knowledge and practice guidance. Not software.
Learning: Lessons and reference material for building the skill.

These are starting points, not endorsements or a procurement shortlist. Nothing here is sponsored, and the list is alphabetical, not ranked. For the platforms I have worked with myself, see Technology.

Start with Your Role

Each guide is a starting workflow: the question, what to produce, the steps and the resources that fit.

Enterprise ArchitectPortfolio DecisionsWhat should change across the portfolio, and why?
Leave with: A capability-to-application view and a short decision list.
1. List the applications in scope and the business capabilities each one supports.
2. Mark overlaps, gaps and end-of-life technology.
3. Give each application a disposition (keep, invest, migrate, retire) with a reason.
4. Turn the dispositions into a sequenced roadmap someone owns.
Where to Start
1. TOGAF Standard: the method and the shared vocabulary
2. ArchiMate: the notation your models and tools will share
3. Archi: a free editor to practise the notation before buying a platform
Reading
- Enterprise Architecture as Strategy (Jeanne W. Ross, Peter Weill and David C. Robertson; Harvard Business Review Press, 2006): Operating models and the foundation for execution; still the clearest case for why a portfolio needs an architecture. ISBN 9781591398394. In the catalog: “Operating model first, then architecture: the diversification, coordination, replication, and unification quadrants still explain why two companies with the same ERP need different integration strategies.” Catalog (opens in a new tab)
- Enterprise Architecture at Work (Marc Lankhorst et al.; Springer, 4th edition, 2017): The ArchiMate book: modelling, analysis and communication across the layers.
Resources for This Job
When this is not enough: A portfolio view without agreed ownership and a data refresh routine goes stale within a quarter. For systems engineering or defense programs that need model-based views, look at OMG's Unified Architecture Framework rather than ArchiMate.
On This Site
- Writing A Disposition Is a Decision, Not a Field
- Diagram Application Portfolio Metamodel Process
- Work Application Portfolio Rationalization
Business ArchitectBusiness AlignmentWhich capabilities and value streams deliver this outcome?
Leave with: A capability map with the outcome traced to the capabilities it needs.
1. Name the outcome in business terms, not system terms.
2. Map the capabilities involved, one level deeper than feels comfortable.
3. Trace the value stream stages that use them.
4. Flag the capabilities that are weak, duplicated or unowned.
Where to Start
1. BIZBOK Guide: capability maps and value streams, the business architect's core artifacts
2. BPMN: the process notation everyone else can read
3. ArchiMate: to connect business models to the application and technology layers
Reading
- Business Model Generation (Alexander Osterwalder and Yves Pigneur; Wiley, 2010): The business model canvas is the artifact business architects are most often asked to produce or map capabilities against.
- Designed for Digital (Jeanne W. Ross, Cynthia M. Beath and Martin Mocker; The MIT Press, 2019; paperback 2021): The successor to Enterprise Architecture as Strategy: a business designed around shared platforms and components, not projects.
- Good Strategy Bad Strategy (Richard Rumelt; Crown Currency, 2011): Half the job is translating strategy into capabilities; this is the test for whether there is a strategy to translate.
Resources for This Job
When this is not enough: Capability maps need business owners to agree on them, or they stay an IT artifact.
On This Site
- Writing Every App Needs Two Capabilities
- Diagram Application Portfolio Metamodel Process
Solution ArchitectSolution DesignHow does this solution fit together and meet its constraints?
Leave with: A system context view, the key interfaces and a decision record.
1. Define the users, the system boundary and external dependencies, and record the constraints (cost, time, scope, compliance, quality, technology, people) before weighing options.
2. Sketch the context before splitting it into deployable parts.
3. Name the important interfaces and quality constraints.
4. Record the major decision, the alternatives and what still needs proving.
5. Review it with whoever will build and run it.
Where to Start
1. C4 model: context before containers; most design conversations need only the first two levels
2. Architecture Decision Records: one page per decision, kept with the code
3. Structurizr: when hand-drawn C4 diagrams start to drift from each other
Reading
- Software Systems Architecture (Nick Rozanski and Eóin Woods; Addison-Wesley, 2nd edition, 2011): Viewpoints and perspectives: the discipline behind a context view that stakeholders can read.
- Designing Data-Intensive Applications (Martin Kleppmann and Chris Riccomini; O'Reilly, 2nd edition, 2026): What storage, replication and messaging choices cost you, explained from first principles. ISBN 9781098119065, 2nd edition 2026. In the catalog: “The one book to read on how storage, replication, consensus, and stream processing actually behave under failure. It replaces a shelf of vendor documentation with the ideas underneath.” Catalog (opens in a new tab)
- The Software Architect Elevator (Gregor Hohpe; O'Reilly, 2020): Riding between the boardroom and the engine room, which is most of the solution architect's week. ISBN 9781492077541. In the catalog: “The architect as the person who rides between the executive penthouse and the engine room and carries meaning both ways. Full of reusable metaphors for explaining technical decisions to leadership.” Catalog (opens in a new tab)
Resources for This Job
When this is not enough: A diagram is not a design review; regulated or high-risk changes need formal sign-off.
On This Site
- Diagram Technology Intake Checklist
- Work Blueprint Modeler: A Free CSDM Architecture Canvas
Software ArchitectSoftware DesignHow do the components, dependencies and quality trade-offs fit?
Leave with: Container and component views plus a list of quality-attribute questions.
1. Pick the two or three quality attributes that matter most.
2. Draw containers, then components, only where it helps a decision.
3. Find the dependencies that make change expensive.
4. Write a decision record for each trade-off you accept.
Where to Start
1. C4 model: a shared way to draw the system at four zoom levels
2. Architecture Decision Records: the record reviewers will ask for
3. ArchUnit: to enforce the layering you drew where the code is built
Reading
- Fundamentals of Software Architecture (Mark Richards and Neal Ford; O'Reilly, 2nd edition, 2025): Architecture characteristics, styles and trade-offs in one place; the book behind the Software Architecture Monday lessons. ISBN 9781098175511, 2nd edition 2025. In the catalog: “The clearest modern statement that architecture is trade-off analysis, with a vocabulary of styles and characteristics you can use in a review the next day.” Catalog (opens in a new tab)
- Clean Architecture (Robert C. Martin; Pearson, 2017): Dependency direction and boundaries, the rules ArchUnit lets you enforce. ISBN 9780134494166. In the catalog: “The dependency rule in one book: business rules in the middle, frameworks and databases at the edge. Useful as a shared vocabulary even when a team does not adopt every layer.” Catalog (opens in a new tab)
- Software Architecture: The Hard Parts (Neal Ford, Mark Richards, Pramod Sadalage and Zhamak Dehghani; O'Reilly, 2021): How to pull a system apart and decide what data and workflow each part owns. ISBN 9781492086895. In the catalog: “Picks up where Fundamentals leaves off and works through the decisions that have no clean answer: where to cut a service, who owns the data, and how to document the trade-off you chose.” Catalog (opens in a new tab)
Resources for This Job
When this is not enough: Views drift from the code unless they are generated from it or reviewed on purpose.
Data ArchitectData DesignWhat data exists, what does it mean, and how does it move?
Leave with: A conceptual or logical data view with ownership and flow notes.
1. Name the core entities in business language.
2. Assign an owner and an authoritative source to each.
3. Trace how data moves between systems and where it is copied.
4. Note the quality, retention and sensitivity rules that apply.
5. Define the certified metrics people and AI will query, each with an owner, a definition and lineage, before building dashboards on them.
Where to Start
1. DAMA-DMBOK: the vocabulary for governance, modelling and quality
2. Sparx Enterprise Architect: conceptual and logical models in one repository
3. Bizzdesign Hopex: when data architecture has to join an enterprise repository
Reading
- Fundamentals of Data Engineering (Joe Reis and Matt Housley; O'Reilly, 2022): The data lifecycle and its undercurrents (security, governance, orchestration) without tying you to one vendor. ISBN 9781098108304. In the catalog: “A tool-agnostic map of the data engineering lifecycle, from ingestion to serving, with the undercurrents (security, data management, orchestration) that every stage shares.” Catalog (opens in a new tab)
- Data Management at Scale (Piethein Strengholt; O'Reilly, 2nd edition, 2023): Domain ownership, data products and governance at enterprise scale, mesh and fabric included.
Resources for This Job
When this is not enough: Models do not fix ownership; governance decisions still have to be made by people. For a data mesh, start from a published list of platform services (the DoD CDAO reference architecture is one) instead of inventing them.
On This Site
- Diagram Identity Lifecycle Attribute Flow
- Writing The Missing Middle: Why Business Apps Shouldn't Point at Servers
Cloud and Platform ArchitectPlatform DesignWhere does the workload run, and how will it operate?
Leave with: A deployment view with reliability, security and cost questions.
1. Place the workload: region, network boundary and shared services.
2. Draw the deployment view, including what is shared and what is dedicated.
3. Walk the Well-Architected pillars: for each, record the target, the design choice, its main risk and which pillar it trades against.
4. Run the provider's own review (the AWS tool or the Azure assessment) for the service-specific checks, and record the decisions.
5. Name who operates it and how failure is detected.
Where to Start
1. C4 model: a context and deployment view before any provider detail
2. Azure Well-Architected Framework: or the AWS or Google Cloud entry, whichever runs your workload
3. draw.io: free deployment diagrams with the providers' icon sets
Reading
- Cloud Strategy (Gregor Hohpe; Self-published (Architect Elevator), updated 2024): Decision models for migration, lock-in and multi-cloud, instead of a feature tour.
- Site Reliability Engineering (Betsy Beyer, Chris Jones, Jennifer Petoff and Niall Richard Murphy (editors); O'Reilly, 2016): Error budgets, toil and on-call: how a platform is run, free to read online. ISBN 9781491929124. In the catalog: “Where SLOs, error budgets, and blameless postmortems come from. Take the principles and leave the scale; most organizations need the chapters on toil and on-call, not the ones on planet-scale systems.” Catalog (opens in a new tab) Read free
Resources for This Job
When this is not enough: A framework review does not replace load, failover or cost testing; each framework is written by its provider for its own services and says little about portability.
On This Site
- Diagram Azure Hub-Spoke Network
- Diagram Azure Virtual Desktop at Scale
- Work Migration of Citrix to Azure Virtual Desktop
Security ArchitectSecurity ReviewWhat are we protecting, and where can trust fail?
Leave with: A threat model and a ranked list of controls to review.
1. Draw the data flows and mark the trust boundaries.
2. Walk each element with a structured method such as STRIDE.
3. Rank the threats by impact and likelihood.
4. Turn the top threats into control requirements with owners.
5. Set the zero trust target: assess current and target maturity by pillar, and decide where access decisions are made.
Where to Start
1. OWASP Threat Modeling: the first review most teams can run in an afternoon
2. NIST Cybersecurity Framework 2.0: to describe posture and target state in one framework
3. NIST SP 800-207 Zero Trust Architecture: the zero trust model behind most current roadmaps
Reading
- Enterprise Security Architecture (John Sherwood, Andrew Clark and David Lynas; CRC Press, 2005): The SABSA book: the full method behind the matrices and the business attributes profile.
- Threat Modeling: Designing for Security (Adam Shostack; Wiley, 2014; 2nd edition due 2027): STRIDE and the four questions, in depth; the method the OWASP cheat sheet summarises. ISBN 9781118809990. In the catalog: “The standard text on asking what can go wrong before the design is finished, with STRIDE as the working checklist. Makes security review something an architect can run, not just request.” Catalog (opens in a new tab)
- Security Engineering (Ross Anderson; Wiley, 3rd edition, 2020): How real systems fail, from banking to voting; the full third edition is free on the author's site. ISBN 9781119642787, 3rd edition 2020. In the catalog: “The broadest single treatment of how systems fail against adversaries, from protocols to economics to human factors. Long; use it as a reference rather than a read-through.” Catalog (opens in a new tab) Read free
Resources for This Job
When this is not enough: A threat model is a point-in-time review; repeat it when the design changes. Zero trust is a multi-year roadmap, not a control you switch on.
On This Site
- Diagram TLS Certificate Architecture Standard
- Writing Migrating a Windows Server 2012 PKI to 2022
- Work Cyber Security and Vulnerability Implementation
AI ArchitectAI AssuranceWhat may the AI read, decide, send and change?
Leave with: An AI system boundary view and a risk and evaluation checklist.
1. Draw the boundary: inputs, tools, data sources and outputs.
2. List what the system can read, decide, send and change, and who approves each.
3. Map the risks with a recognized framework and pick the controls.
4. Define how you will evaluate quality and failure before launch and after.
Where to Start
1. NIST AI Risk Management Framework: govern, map, measure and manage: the questions to ask first
2. OWASP Top 10 for LLM Applications: the failure modes to design against
3. garak: evidence from testing your own model, not a checklist
Reading
- AI Engineering (Chip Huyen; O'Reilly, December 2024): The best single treatment of evaluation, the step in the AI workflow that most teams skip.
- Adversarial AI Attacks, Mitigations, and Defense Strategies (John Sotiropoulos; Packt, 2024): By a co-lead of the OWASP Top 10 for LLM Applications; the threats and the controls, with MLSecOps.
- Designing Machine Learning Systems (Chip Huyen; O'Reilly, 2022): The pre-LLM half of the job: data, monitoring and drift, which generative AI projects inherit whether they plan to or not.
Resources for This Job
When this is not enough: Frameworks guide the questions, but the evidence comes from testing your own system. AI answers are only as good as the governed definitions behind them, and anything AI drafts stays a draft until a named person approves it.
On This Site
- Writing Building an AI Second Brain for Enterprise Architecture
- Writing Absent, Not Disabled: Giving a Small Model Read Tools
- Writing A Dry Run Is Not Permission
- Writing Never Let the Generator Grade Its Own Work
- Writing Green Tests, Broken System: 4 Ways a Test Suite Lies
- Work AI-Maintained Architecture Second-Brain Repository

Resources

Alphabetical, not ranked. Open Details for the evidence behind each one, or pick two or three tools to compare.

Compare Tools

3 of 3 selected

Default comparison: three portfolio platforms I've used. Change it with the Compare buttons on any tool.

That's the most you can compare at once. Remove one to add another.

Comparison of Ardoq, SAP LeanIX, Orbus iServer and OrbusInfinity
Field	ArdoqArdoq AS	SAP LeanIXSAP	Orbus iServer and OrbusInfinityOrbus Software
Purpose	A SaaS enterprise architecture platform that keeps applications, capabilities and dependencies in one graph for planning and governance.	A SaaS inventory of applications, capabilities and technology for assessing the portfolio and planning change.	Orbus's architecture repository: iServer is the self-hosted, Visio-based product and OrbusInfinity is the current SaaS platform.
Category	EA Platforms	EA Platforms	EA Platforms
Fits	Enterprise Architect, Business Architect	Enterprise Architect, Business Architect	Enterprise Architect, Business Architect, Solution Architect
Helps you produce	Application portfolio views Capability maps and value streams Future-state scenarios and roadmaps Dependency views	Application fact sheets and portfolio assessments Business capability maps Technology risk and roadmap views	TOGAF, ArchiMate and UML models Impact analysis Generated documents and Power BI reports
Deployment	Vendor-hosted (SaaS)	Vendor-hosted (SaaS)	Self-hosted, Vendor-hosted (SaaS)
Access	Commercial subscription, priced per application	Commercial subscription, priced per application	Commercial; quote only
License	Proprietary	Proprietary	Proprietary
AI features	Documents an AI assistant, AI-generated capability maps and value streams, and an MCP server; some listed items are roadmap entries or paid add-ons.	Documents an enterprise architecture assistant, Joule in SAP LeanIX, an inventory builder and an MCP server.	OrbusInfinity documents the O.ai assistant, an O.ai agent network, AI dashboards and AI-enabled automation.
Edition	Not stated	Not stated	iServer (self-hosted) and OrbusInfinity (SaaS, including a Government edition)
Pricing model	Per application, with unlimited users; quote only. Source: Pricing (opens in a new tab)	Per application in tiers, with no user limit; quote only. Source: Pricing (opens in a new tab)	Quote only; unlimited viewers, priced by authors, contributors, integrations and support tier. Source: OrbusInfinity pricing (opens in a new tab)
Industry recognition	Ardoq says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note	SAP says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 16, 2025 (opens in a new tab) Gartner note	Orbus Software says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools (for OrbusInfinity). Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Think twice	Ask which AI features are generally available, which are on the roadmap and which cost extra. (editorial)	Pricing is per application, so agree on what counts as an application before you load data. (editorial)	Hosted iServer ended on 31 December 2024; new buyers get OrbusInfinity, so check which product a reference is about. (editorial)
How I know it	I've used it	I've used it	Used it in 2012
Checked	October 3, 2026	October 3, 2026	October 3, 2026

Ardoq

Ardoq AS

Purpose: A SaaS enterprise architecture platform that keeps applications, capabilities and dependencies in one graph for planning and governance.
Category: EA Platforms
Fits: Enterprise Architect, Business Architect
Helps you produce: Application portfolio views
Capability maps and value streams
Future-state scenarios and roadmaps
Dependency views
Deployment: Vendor-hosted (SaaS)
Access: Commercial subscription, priced per application
License: Proprietary
AI features: Documents an AI assistant, AI-generated capability maps and value streams, and an MCP server; some listed items are roadmap entries or paid add-ons.
Edition: Not stated
Pricing model: Per application, with unlimited users; quote only. Source: Pricing (opens in a new tab)
Industry recognition: Ardoq says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Think twice: Ask which AI features are generally available, which are on the roadmap and which cost extra. (editorial)
How I know it: I've used it
Checked: October 3, 2026

SAP LeanIX

SAP

Purpose: A SaaS inventory of applications, capabilities and technology for assessing the portfolio and planning change.
Category: EA Platforms
Fits: Enterprise Architect, Business Architect
Helps you produce: Application fact sheets and portfolio assessments
Business capability maps
Technology risk and roadmap views
Deployment: Vendor-hosted (SaaS)
Access: Commercial subscription, priced per application
License: Proprietary
AI features: Documents an enterprise architecture assistant, Joule in SAP LeanIX, an inventory builder and an MCP server.
Edition: Not stated
Pricing model: Per application in tiers, with no user limit; quote only. Source: Pricing (opens in a new tab)
Industry recognition: SAP says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 16, 2025 (opens in a new tab) Gartner note
Think twice: Pricing is per application, so agree on what counts as an application before you load data. (editorial)
How I know it: I've used it
Checked: October 3, 2026

Orbus iServer and OrbusInfinity

Orbus Software

Purpose: Orbus's architecture repository: iServer is the self-hosted, Visio-based product and OrbusInfinity is the current SaaS platform.
Category: EA Platforms
Fits: Enterprise Architect, Business Architect, Solution Architect
Helps you produce: TOGAF, ArchiMate and UML models
Impact analysis
Generated documents and Power BI reports
Deployment: Self-hosted, Vendor-hosted (SaaS)
Access: Commercial; quote only
License: Proprietary
AI features: OrbusInfinity documents the O.ai assistant, an O.ai agent network, AI dashboards and AI-enabled automation.
Edition: iServer (self-hosted) and OrbusInfinity (SaaS, including a Government edition)
Pricing model: Quote only; unlimited viewers, priced by authors, contributors, integrations and support tier. Source: OrbusInfinity pricing (opens in a new tab)
Industry recognition: Orbus Software says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools (for OrbusInfinity). Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Think twice: Hosted iServer ended on 31 December 2024; new buyers get OrbusInfinity, so check which product a reference is about. (editorial)
How I know it: Used it in 2012
Checked: October 3, 2026

Tool · ModelingI've used it
Archi
Phillip Beauvoir and Jean-Baptiste Sarrodie
A free desktop editor for building ArchiMate models, views and sketches.
Access
No cost; some plugins are for supporters only
Fits
Enterprise Architect, Business Architect
Details for Archi
Use it when
You want to learn or apply ArchiMate without a license budget.
One person or a small team keeps models in files under version control.
Helps you produce
ArchiMate models and views
Sketch views
Scripted reports (with the jArchi plugin)
Think twice
Team work depends on git-based collaboration plugins; check which version you need and whether it is for supporters only. (editorial)
Deployment
Desktop app
License
MIT
AI features
Not found on reviewed pages
Edition
5.10.0 (September 2026)
Experience
I've used it. Mike has used this in his own work.
Sources
Archi (Archi) (opens in a new tab)
Download Archi (Archi) (opens in a new tab)
License.txt (Archi on GitHub) (opens in a new tab)
Checked
October 3, 2026
Visit Archi (opens in a new tab)
Method or StandardI've used it
ArchiMate
The Open Group
The Open Group's standard visual language for modeling business, application and technology architecture together.
Access
Free for non-commercial use, with registration; commercial use needs a license
Fits
Enterprise Architect, Business Architect, Solution Architect
Details for ArchiMate
Use it when
Several architects must read each other's models the same way.
Views must connect strategy, business, applications and technology.
Helps you produce
Layered architecture views
Capability and application cooperation views
Model exchange files
Think twice
It pays off only with a tool and modeling discipline behind it; read the license before commercial use. (editorial)
Deployment
Not applicable
License
Open Group license
AI features
Not applicable
Edition
ArchiMate 4
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
ArchiMate Forum (The Open Group) (opens in a new tab)
ArchiMate 4 evaluation license (The Open Group) (opens in a new tab)
Checked
October 3, 2026
Visit ArchiMate (opens in a new tab)
Method or StandardUsed and developed
Architecture Decision Records
Michael Nygard; ADR community
A short record of each significant design decision: the context, the choice and its consequences.
Access
No cost
Fits
Solution Architect, Software Architect, Enterprise Architect
Blueprint Catalog
Pattern: Architecture Decision Records (opens in a new tab)
Details for Architecture Decision Records
Use it when
A decision will be questioned later by people who were not in the room.
You want design reviews to leave a trail.
Helps you produce
Decision records
A decision log
Think twice
A template doesn't create the habit; decide where records live and who writes them. (editorial)
Deployment
Not applicable
License
Original post CC0; adr.github.io MIT
AI features
Not applicable
Edition
Practice described by Michael Nygard in 2011
Experience
Used and developed. Mike has used this in his own work.
Sources
Architectural Decision Records (ADR GitHub organization) (opens in a new tab)
Documenting Architecture Decisions (Cognitect (Michael Nygard)) (opens in a new tab)
Checked
October 3, 2026
Visit Architecture Decision Records (opens in a new tab)
Tool · Architecture ConformanceResearched
ArchUnit
TNG Technology Consulting
An open-source Java library that checks architecture rules (package dependencies, layers, cycles, naming) as ordinary unit tests over the compiled code.
Access
No cost
Fits
Software Architect
Blueprint Catalog
Pattern: Fitness Functions (opens in a new tab)
Details for ArchUnit
Use it when
A layered or hexagonal design keeps eroding between reviews.
You want the architecture decision enforced where the code is built, not in a document.
Helps you produce
Architecture rules as test classes in the build
CI reports of rule violations
A frozen baseline of tolerated violations to burn down
Think twice
JVM code only (a separate ArchUnitNET fork covers .NET); it analyses bytecode, so large codebases need class caching to keep test time down. (editorial)
Deployment
Desktop app, Self-hosted
License
Apache-2.0
AI features
None
Edition
1.5.1 (September 2026)
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
ArchUnit (TNG Technology Consulting) (opens in a new tab)
ArchUnit user guide (TNG Technology Consulting) (opens in a new tab)
TNG/ArchUnit on GitHub (TNG Technology Consulting) (opens in a new tab)
Releases (TNG Technology Consulting on GitHub) (opens in a new tab)
Checked
October 10, 2026
Visit ArchUnit (opens in a new tab)
Tool · Documentation and DecisionsResearched
ArcKit
Mark Craddock (tractorjuice)
Open-source commands for AI coding assistants that draft architecture governance records (decisions, risks, requirements) as Markdown in Git.
Access
No cost; needs an AI coding assistant subscription
Fits
Enterprise Architect, Solution Architect, AI Architect
Details for ArcKit
Use it when
Your team already works in Git with an AI coding assistant and wants governance records next to the code.
You want a draft to review, with its provenance recorded, rather than a blank page.
Helps you produce
Draft ADRs, risk registers and requirements in Git
Traceability matrices and design reviews
Wardley maps
Think twice
Every output stays DRAFT until a named person signs it off. The core follows UK government practice, releases are frequent (pin a version), and it needs a paid AI assistant. (editorial)
Deployment
Desktop app
License
MIT core; the UK G-Cloud overlay is proprietary
AI features
Built for AI coding assistants (Claude Code first; also Gemini CLI, Codex CLI, OpenCode, GitHub Copilot and Kimi Code); records the provenance of what they generate.
Edition
v6.15.0 (September 2026)
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
arc-kit on GitHub (tractorjuice) (opens in a new tab)
ArcKit (arckit.org) (opens in a new tab)
LICENSE (tractorjuice on GitHub) (opens in a new tab)
Releases (tractorjuice on GitHub) (opens in a new tab)
Checked
October 10, 2026
Visit ArcKit (opens in a new tab)
Tool · EA PlatformsI've used it
Ardoq
Ardoq AS
A SaaS enterprise architecture platform that keeps applications, capabilities and dependencies in one graph for planning and governance.
Access
Commercial subscription, priced per application
Fits
Enterprise Architect, Business Architect
Details for Ardoq
Use it when
The portfolio needs one shared inventory that many teams update.
You plan change with scenarios rather than single diagrams.
Helps you produce
Application portfolio views
Capability maps and value streams
Future-state scenarios and roadmaps
Dependency views
Think twice
Ask which AI features are generally available, which are on the roadmap and which cost extra. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents an AI assistant, AI-generated capability maps and value streams, and an MCP server; some listed items are roadmap entries or paid add-ons.
Pricing model
Per application, with unlimited users; quote only. Source: Pricing (opens in a new tab)
Industry recognition
Ardoq says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
Ardoq (Ardoq) (opens in a new tab)
Plans (Ardoq) (opens in a new tab)
AI and innovation (Ardoq) (opens in a new tab)
Pricing (Ardoq AS) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (Ardoq) (opens in a new tab)
Checked
October 3, 2026
Visit Ardoq (opens in a new tab)
Method or StandardUsed it since its inception
AWS Well-Architected Framework
Amazon Web Services
Amazon's six-pillar framework of design principles, questions and best practices for AWS workloads, with a no-charge review tool and lenses.
Access
No cost; the Well-Architected Tool is a no-charge AWS service
Fits
Cloud and Platform Architect, Solution Architect
Details for AWS Well-Architected Framework
Use it when
You are designing or reviewing a workload that runs on AWS.
You want a repeatable review whose findings are tracked over time.
Helps you produce
Pillar-by-pillar workload reviews
Improvement plans from the Well-Architected Tool
Lens reviews, including generative AI and machine learning
Think twice
Written by AWS for AWS services; the framework text dates from November 2024, so check the per-pillar guides and lenses for newer practice. (editorial)
Deployment
Not applicable
License
Docs CC BY-SA 4.0 (AWS Site Terms)
AI features
Not applicable
Edition
Framework revised November 2024; Generative AI Lens November 2025
Experience
Used it since its inception. Mike has used this in his own work.
Sources
AWS Well-Architected Framework (AWS Documentation) (opens in a new tab)
The pillars of the framework (AWS Documentation) (opens in a new tab)
Lens Catalog (AWS Documentation) (opens in a new tab)
Generative AI Lens (AWS Documentation) (opens in a new tab)
AWS Site Terms (Amazon Web Services) (opens in a new tab)
Checked
October 10, 2026
Visit AWS Well-Architected Framework (opens in a new tab)
Method or StandardI've used it
Azure Well-Architected Framework
Microsoft
Microsoft's design principles, checklists and trade-offs for reliable, secure and cost-aware workloads on Azure.
Access
No cost
Fits
Cloud and Platform Architect, Solution Architect
Details for Azure Well-Architected Framework
Use it when
You are designing or reviewing a workload that runs on Azure.
Reliability, security and cost need to be weighed together.
An AI workload on Azure needs the AI workload guide's design areas covered.
Helps you produce
Workload design reviews
Pillar checklists
Recorded trade-off decisions
Azure Architecture Review assessment
Think twice
Azure-specific in its detail, although the pillars carry over to other clouds; the review assessment is a self-review, not certification. (editorial)
Deployment
Not applicable
License
Docs CC BY 4.0
AI features
Not applicable
Edition
Not versioned; updated September 2026
Experience
I've used it. Mike has used this in his own work.
Sources
Azure Well-Architected Framework (Microsoft Learn) (opens in a new tab)
well-architected repository (Microsoft on GitHub) (opens in a new tab)
AI workloads on Azure (Microsoft Learn) (opens in a new tab)
Checked
October 10, 2026
Visit Azure Well-Architected Framework (opens in a new tab)
Method or StandardI've used it
BIAN Service Landscape
BIAN e.V.
The banking industry's reference architecture: 322 service domains in a service landscape, with semantic API specifications published under Apache-2.0.
Access
No cost; portal and landscape views need a registration form
Fits
Business Architect, Enterprise Architect
Details for BIAN Service Landscape
Use it when
You architect for a bank or insurer and need a shared service vocabulary.
An application portfolio needs mapping to an industry reference rather than a home-grown model.
Helps you produce
Service landscape views mapped to your application portfolio
Capability and service domain gap analysis
API designs aligned to the semantic specifications
Think twice
Banking-specific. The portal and landscape views sit behind a registration form, and only the GitHub API artefacts carry an open licence; the landscape model itself is all rights reserved. (editorial)
Deployment
Not applicable
License
Semantic APIs Apache-2.0; Service Landscape all rights reserved
AI features
Not applicable
Edition
Service Landscape 14.0 (February 2026)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
BIAN (BIAN e.V.) (opens in a new tab)
Service Landscape (BIAN e.V.) (opens in a new tab)
BIAN v14.0 release notes (PDF) (BIAN e.V.) (opens in a new tab)
bian-official on GitHub (BIAN) (opens in a new tab)
Imprint (BIAN e.V.) (opens in a new tab)
Checked
October 10, 2026
Visit BIAN Service Landscape (opens in a new tab)
Method or StandardI've used it
BIZBOK Guide
Business Architecture Guild
The Business Architecture Guild's body of knowledge for capability maps, value streams and related business blueprints.
Access
Introduction and glossary free; full guide for members
Fits
Business Architect, Enterprise Architect
Details for BIZBOK Guide
Use it when
You are building a first capability map and want a common vocabulary.
Business and IT disagree on what a capability is.
Helps you produce
Capability maps
Value streams
Information and organization maps
Think twice
Most of the substance is for members only; the free parts are an introduction. (editorial)
Deployment
Not applicable
License
Not stated
AI features
Not applicable
Edition
v15.0
Pricing model
Full guide included with Business Architecture Guild membership. Source: Membership (opens in a new tab)
Experience
I've used it. Mike has used this in his own work.
Sources
Free resources (Business Architecture Guild) (opens in a new tab)
Resources (Business Architecture Guild) (opens in a new tab)
Membership (Business Architecture Guild) (opens in a new tab)
Checked
October 3, 2026
Visit BIZBOK Guide (opens in a new tab)
Tool · EA PlatformsResearched
Bizzdesign Alfabet
Bizzdesign (formerly Software AG)
Formerly Software AG Alfabet: strategic portfolio planning that ties application, technology and investment decisions to strategy.
Access
Commercial; price not published; free trial
Fits
Enterprise Architect, Business Architect
Details for Bizzdesign Alfabet
Use it when
Portfolio and investment planning, not modeling, is the main job.
Leaders need roadmaps tied to funding decisions.
Helps you produce
Application and technology portfolios
Investment roadmaps
Executive dashboards
Think twice
References to 'Software AG Alfabet' are out of date; Bizzdesign has owned it since January 2025. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents AI-enhanced portfolio decision-making.
Edition
SaaS, plus Bizzdesign GovCloud (FedRAMP)
Pricing model
Price not published; free trial. Source: Alfabet (opens in a new tab)
Industry recognition
Bizzdesign says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools (announced for Bizzdesign as a vendor). Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
Alfabet (Bizzdesign) (opens in a new tab)
Bizzdesign adds Alfabet after closing MEGA (press release) (Bizzdesign) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (Bizzdesign) (opens in a new tab)
Checked
October 3, 2026
Visit Bizzdesign Alfabet (opens in a new tab)
Tool · EA PlatformsUsed it in 2010 (as MEGA HOPEX)
Bizzdesign Hopex
Bizzdesign (formerly MEGA International)
Formerly MEGA HOPEX: one repository connecting enterprise architecture, portfolios, processes, data and governance, risk and compliance.
Access
Commercial; quote only
Fits
Enterprise Architect, Business Architect, Data Architect
Details for Bizzdesign Hopex
Use it when
Architecture, risk and compliance teams need one shared repository.
You already run HOPEX and are planning its future.
Helps you produce
Architecture models
Application and technology portfolios
Process and data maps
GRC frameworks
Think twice
Bizzdesign completed its merger with MEGA in January 2025; treat Hopex as part of the Bizzdesign suite, not a standalone MEGA product. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents AI capability mapping, generative AI and ML discovery, and AI data enrichment.
Pricing model
Quote only. Source: Hopex (opens in a new tab)
Industry recognition
Bizzdesign says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools (announced for Bizzdesign as a vendor). Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Experience
Used it in 2010 (as MEGA HOPEX). Mike has used this in his own work. See it on my Technology page.
Sources
Hopex (Bizzdesign) (opens in a new tab)
Bizzdesign adds Alfabet after closing MEGA (press release) (Bizzdesign) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (Bizzdesign) (opens in a new tab)
Checked
October 3, 2026
Visit Bizzdesign Hopex (opens in a new tab)
Tool · EA PlatformsUsed it 2024–2025
Bizzdesign Horizzon
Bizzdesign
Bizzdesign's modeling platform for linking strategy, architecture and process design in one repository.
Access
Commercial; quote only
Fits
Enterprise Architect, Business Architect, Solution Architect
Details for Bizzdesign Horizzon
Use it when
Several architects model to standard notations in a shared repository.
Business and process models must connect to the architecture.
Helps you produce
ArchiMate, BPMN, C4, ERD and UML models
Roadmaps and impact analysis
Think twice
It is now one of four products in a suite (with Unify, Hopex and Alfabet); be clear which one a proposal or licence covers. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents AI-assisted architecture design; Bizzdesign reports natural-language interaction and an MCP server added in 2025.
Pricing model
Quote only; free trial of Unify. Source: Horizzon (opens in a new tab)
Industry recognition
Bizzdesign says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Experience
Used it 2024–2025. Mike has used this in his own work. See it on my Technology page.
Sources
Horizzon (Bizzdesign) (opens in a new tab)
Bizzdesign enters 2026 (press release) (Bizzdesign) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (Bizzdesign) (opens in a new tab)
Checked
October 3, 2026
Visit Bizzdesign Horizzon (opens in a new tab)
Tool · ModelingBuilt by Mike
Blueprint Modeler
Mike Reams
A free, browser-only canvas for modeling applications in ServiceNow CSDM, with rules that flag invalid relationships as you draw.
Access
No cost, no sign-up
Fits
Enterprise Architect, Solution Architect, Cloud and Platform Architect
Details for Blueprint Modeler
Use it when
You need a CSDM-shaped picture of one application before it goes into the CMDB.
You want to check relationships against public CSDM guidance.
Helps you produce
CSDM application models
ArchiMate-notation views
SVG, draw.io and ServiceNow import files
Think twice
Models live in your browser, so export regularly. It is a new tool with one maintainer and no affiliation with ServiceNow. (editorial)
Deployment
Runs in your browser
License
MIT
AI features
None
Experience
Built by Mike Reams, who writes this guide. Listed in the same order and checked against the same rules as everything else.
On this site
Blueprint Modeler: A Free CSDM Architecture Canvas
Every Rule Needs a Source: Building a CSDM Modeler from Public Material Only
Sources
README (Blueprint Modeler on GitHub) (opens in a new tab)
LICENSE (Blueprint Modeler on GitHub) (opens in a new tab)
Checked
October 3, 2026
Visit Blueprint Modeler (opens in a new tab)
Method or StandardI've used it
BPMN
Object Management Group
The OMG standard notation and XML interchange format for business processes, collaborations and choreographies; also ISO/IEC 19510.
Access
No cost; the specification is a free download from OMG
Fits
Business Architect, Solution Architect
Details for BPMN
Use it when
A process has to be read the same way by business people, analysts and the team automating it.
You need process models that move between tools or into a workflow engine.
Helps you produce
Process diagrams with pools, lanes, tasks, gateways and events
Collaboration and choreography diagrams
BPMN 2.0 XML files that tools can exchange
Think twice
The specification has not changed since 2013 and interchange between tools is imperfect; BPMN is an OMG trademark, so do not use it in a product name. (editorial)
Deployment
Not applicable
License
Royalty-free OMG specification; BPMN is an OMG trademark
AI features
Not applicable
Edition
2.0.2 (December 2013); ISO/IEC 19510:2013 matches 2.0.1
Experience
I've used it. Mike has used this in his own work.
Sources
Business Process Model and Notation (OMG) (opens in a new tab)
BPMN 2.0.2 specification (PDF) (OMG) (opens in a new tab)
ISO/IEC 19510:2013 (ISO) (opens in a new tab)
OMG trademark guidelines (OMG) (opens in a new tab)
Checked
October 10, 2026
Visit BPMN (opens in a new tab)
Method or StandardDesigned with it
C4 model
Simon Brown
A simple way to diagram software at four levels of zoom: context, containers, components and code.
Access
No cost
Fits
Solution Architect, Software Architect, Cloud and Platform Architect
Details for C4 model
Use it when
Developers and stakeholders need the same picture at different levels of detail.
You want a notation-light alternative to UML.
Helps you produce
System context diagrams
Container and component diagrams
Deployment diagrams
Think twice
It deliberately skips business and enterprise views; pair it with something else for those. (editorial)
Deployment
Not applicable
License
CC BY 4.0
AI features
Not applicable
Experience
Designed with it. Mike has used this in his own work.
Sources
The C4 model (Simon Brown) (opens in a new tab)
Checked
October 3, 2026
Visit C4 model (opens in a new tab)
Method or StandardI've used it
CISA Zero Trust Maturity Model
CISA
CISA's five pillars, three cross-cutting capabilities and four maturity stages for assessing a zero trust current state and target state.
Access
No cost
Fits
Security Architect, Enterprise Architect, Cloud and Platform Architect
Blueprint Catalog
Pattern: Zero Trust (opens in a new tab)
Details for CISA Zero Trust Maturity Model
Use it when
Leadership wants zero trust progress shown as stages, not products.
You need to sequence identity, device, network, application and data work.
Helps you produce
Current and target maturity by pillar
Zero trust roadmap
Gap list across identity, devices, networks, applications and data
Think twice
Written for US federal agencies; the stages are a self-assessment, not certification, and the landing page still carries older wording than the version 2.0 PDF. (editorial)
Deployment
Not applicable
License
TLP:CLEAR; US government work
AI features
Not applicable
Edition
Version 2.0 (April 2023)
Experience
I've used it. Mike has used this in his own work.
Sources
Zero Trust Maturity Model (CISA) (opens in a new tab)
Zero Trust Maturity Model Version 2.0 (PDF) (CISA) (opens in a new tab)
Checked
October 10, 2026
Visit CISA Zero Trust Maturity Model (opens in a new tab)
Method or StandardI've used it
DAMA-DMBOK
DAMA International
DAMA's reference body of knowledge for data management: governance, modeling, quality, metadata and more.
Access
Book purchase
Fits
Data Architect, Enterprise Architect
Details for DAMA-DMBOK
Use it when
You are setting up data governance and need a shared reference.
Data roles and ownership are unclear.
Helps you produce
Data governance frameworks
Data management capability assessments
Roles and responsibilities for data
Think twice
It describes rather than prescribes, and version 3.0 is in progress. (editorial)
Deployment
Not applicable
License
Not stated
AI features
Not applicable
Edition
2nd Edition Revised (2024); 3.0 in progress
Pricing model
Book purchase (print or digital) through Technics Publications. Source: Order DAMA-DMBOK (opens in a new tab)
Experience
I've used it. Mike has used this in his own work.
Sources
DAMA-DMBOK (DAMA International) (opens in a new tab)
Order DAMA-DMBOK (DAMA International) (opens in a new tab)
Checked
October 3, 2026
Visit DAMA-DMBOK (opens in a new tab)
Tool · Diagramming and WhiteboardingI've used it
draw.io
JGraph (draw.io Ltd)
A free, open-source diagram editor that runs in the browser or on the desktop and saves files wherever you choose.
Access
No cost, no account
Fits
Solution Architect, Cloud and Platform Architect, Software Architect
Details for draw.io
Use it when
You need a capable diagram editor with no account or licence.
Diagram files should live next to the code or documents they describe.
Helps you produce
Cloud, C4, UML and BPMN diagrams
Diagrams from Mermaid or PlantUML
Think twice
It keeps no model behind the drawing, and its Generate feature sends prompts to AI providers it doesn't name. (editorial)
Deployment
Runs in your browser, Desktop app, Self-hosted
License
Apache-2.0
AI features
Documents a Generate tool that turns text into diagrams (can be disabled) and an MCP server.
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
draw.io (JGraph) (opens in a new tab)
LICENSE (draw.io on GitHub) (opens in a new tab)
Generate diagrams (JGraph) (opens in a new tab)
Checked
October 3, 2026
Visit draw.io (opens in a new tab)
Tool · AI TestingResearched
garak
NVIDIA
An open-source command-line scanner that probes language models for jailbreaks, prompt injection, data leakage and other failures.
Access
No cost
Fits
AI Architect, Security Architect
Details for garak
Use it when
You need repeatable adversarial tests before an AI feature ships.
A risk assessment needs evidence, not just a checklist.
Helps you produce
Per-probe failure reports
Red-team evidence for AI risk assessments
Think twice
Scanner verdicts are noisy signals, not certification; only test models you're authorized to test. (editorial)
Deployment
Desktop app
License
Apache-2.0
AI features
A test harness for AI models; uses detectors to classify model outputs.
Edition
0.17.0 (September 2026)
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
garak (NVIDIA) (opens in a new tab)
garak on GitHub (NVIDIA) (opens in a new tab)
LICENSE (NVIDIA garak on GitHub) (opens in a new tab)
Checked
October 3, 2026
Visit garak (opens in a new tab)
Method or StandardUsed it since its inception
Google Cloud Well-Architected Framework
Google
Google's six-pillar principles and recommendations for workloads on Google Cloud, with cross-pillar perspectives for AI and ML and for financial services.
Access
No cost
Fits
Cloud and Platform Architect, Solution Architect
Details for Google Cloud Well-Architected Framework
Use it when
You are designing or reviewing a workload that runs on Google Cloud.
An AI or ML workload needs reliability, security and cost weighed together.
Helps you produce
Pillar reviews
Design principle checklists
AI and ML workload reviews
Think twice
Google-specific in its detail, with no self-assessment tool like the AWS and Azure reviews; the AI and ML perspective dates from October 2024. (editorial)
Deployment
Not applicable
License
Docs CC BY 4.0; code samples Apache 2.0
AI features
Not applicable
Edition
Not versioned; updated January 2026
Experience
Used it since its inception. Mike has used this in his own work.
Sources
Google Cloud Well-Architected Framework (Google Cloud Architecture Center) (opens in a new tab)
Checked
October 10, 2026
Visit Google Cloud Well-Architected Framework (opens in a new tab)
Tool · Security ToolsResearched
IriusRisk Community Edition
IriusRisk
A free edition of a web-based threat modeling platform that builds threats and countermeasures from an architecture diagram.
Access
Free edition (3 threat models, 1 user); Enterprise by quote
Fits
Security Architect, Solution Architect, Software Architect
Details for IriusRisk Community Edition
Use it when
You want to try automated threat modeling before buying a platform.
Threats should be generated from components rather than listed by hand.
Helps you produce
Threat model diagrams
Threat and countermeasure registers
Reports
Think twice
Three active threat models and one user make it a trial; don't upload confidential architectures to a vendor-hosted service. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents the Jeff assistant, which drafts diagrams, threats and controls from stories, documents and code.
Pricing model
Free edition; Enterprise priced per threat model with unlimited users, quote only. Source: Plans (opens in a new tab)
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
Community Edition (IriusRisk) (opens in a new tab)
Plans (IriusRisk) (opens in a new tab)
Checked
October 3, 2026
Visit IriusRisk Community Edition (opens in a new tab)
Method or StandardI've used it
ISO/IEC 42001
ISO/IEC
The international standard for setting up, running and improving an AI management system; certifiable by accredited bodies.
Access
Purchase from ISO or a national standards body
Fits
AI Architect, Enterprise Architect
Details for ISO/IEC 42001
Use it when
Your organization wants certifiable AI governance.
Customers or regulators ask how AI is governed.
Helps you produce
AI policy
AI risk and impact assessments
Control records and audit evidence
Think twice
It's a management-system standard, not a technical guide; pair it with ATLAS or the OWASP AI Exchange. (editorial)
Deployment
Not applicable
License
© ISO/IEC, all rights reserved
AI features
Not applicable
Edition
ISO/IEC 42001:2023 (December 2023)
Pricing model
One-off purchase per copy. CHF 225 at iso.org (as of October 3, 2026). Source: ISO/IEC 42001:2023 (opens in a new tab)
Experience
I've used it. Mike has used this in his own work.
Sources
ISO/IEC 42001:2023 (ISO) (opens in a new tab)
Checked
October 3, 2026
Visit ISO/IEC 42001 (opens in a new tab)
Tool · Diagramming and WhiteboardingI've used it
Lucidchart
Lucid Software
A browser-based diagramming tool for drawing and documenting systems and processes together.
Access
Free tier (3 documents); paid per user
Fits
Solution Architect, Cloud and Platform Architect, Business Architect
Details for Lucidchart
Use it when
Many people need to edit and comment on the same diagrams.
You want cloud, C4 and ArchiMate shapes in one tool.
Helps you produce
Cloud architecture diagrams
C4, UML, BPMN and ArchiMate diagrams
Diagrams from Mermaid code
Think twice
It draws pictures rather than keeping a model; shapes generated from Mermaid code can only be changed by editing the code. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents diagram generation, process capture, summarization and an MCP server.
Pricing model
Per user, with a free tier. Individual US$9 per month; Team and Enterprise quoted on the pricing page (as of October 3, 2026). Source: Lucidchart trial and plans (opens in a new tab)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
Lucidchart (Lucid Software) (opens in a new tab)
AI (Lucid Software) (opens in a new tab)
Lucidchart trial and plans (Lucid Software) (opens in a new tab)
Checked
October 3, 2026
Visit Lucidchart (opens in a new tab)
Tool · Diagramming and WhiteboardingI've used it
Microsoft Visio
Microsoft
Microsoft's diagramming tool for flowcharts, network and architecture diagrams, closely tied to Microsoft 365.
Access
Web app bundled with many Microsoft 365 plans; Plans 1 and 2 per user
Fits
Solution Architect, Cloud and Platform Architect, Business Architect
Details for Microsoft Visio
Use it when
Your organization standardizes on Microsoft 365.
Diagrams must link to Excel, SharePoint or SQL Server data.
Helps you produce
Azure and AWS architecture diagrams
UML, BPMN and network diagrams
Data-linked diagrams
Think twice
The web app bundled with Microsoft 365 isn't the full product; the desktop app and two-way data sync need Plan 2. (editorial)
Deployment
Vendor-hosted (SaaS), Desktop app
License
Proprietary
AI features
Not found on reviewed pages
Pricing model
Per user subscription, bundled with Microsoft 365, or a one-time purchase. Plan 1 US$5, Plan 2 US$15 per user per month, billed yearly (as of October 3, 2026). Source: Compare Visio plans (opens in a new tab)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
Compare Visio plans (Microsoft) (opens in a new tab)
Checked
October 3, 2026
Visit Microsoft Visio (opens in a new tab)
Tool · Diagramming and WhiteboardingI've used it
Miro
Miro
An online whiteboard for brainstorming and diagramming together, with AI agents and workflows built in.
Access
Free tier (3 boards); paid per member
Fits
Business Architect, Solution Architect, Software Architect
Details for Miro
Use it when
Teams brainstorm and diagram on the same canvas.
You need imports from Lucidchart, Visio or draw.io.
Helps you produce
Workshop boards
Cloud, UML and BPMN diagrams
Diagrams from Mermaid code
Think twice
The full architecture shape libraries need the Business plan, and AI use is capped by credits that vary by plan. (editorial)
Deployment
Vendor-hosted (SaaS), Desktop app
License
Proprietary
AI features
Documents AI agents (Sidekicks), multi-step AI workflows, diagram generation from prompts and an MCP server.
Pricing model
Per member, with a free tier. Starter US$8 and Business US$20 per member per month, billed yearly; Enterprise custom (as of October 3, 2026). Source: Pricing (opens in a new tab)
Experience
I've used it. Mike has used this in his own work.
Sources
Miro (Miro) (opens in a new tab)
Pricing (Miro) (opens in a new tab)
Diagramming (Miro) (opens in a new tab)
Checked
October 3, 2026
Visit Miro (opens in a new tab)
Method or StandardI've used it
MITRE ATLAS
The MITRE Corporation
An ATT&CK-style knowledge base of adversary tactics, techniques and case studies aimed at AI systems, including agents.
Access
No cost
Fits
AI Architect, Security Architect
Details for MITRE ATLAS
Use it when
You are threat modeling an AI system.
Security and AI teams need shared names for AI attacks.
Helps you produce
AI threat models
Red-team plans
Mitigation mapping
Think twice
It releases roughly monthly and technique IDs change; cite the version you used. (editorial)
Deployment
Not applicable
License
Data: Apache-2.0
AI features
Not applicable
Edition
v2026.09 (September 2026)
Experience
I've used it. Mike has used this in his own work.
Sources
MITRE ATLAS (The MITRE Corporation) (opens in a new tab)
atlas-data v2026.09 (MITRE ATLAS on GitHub) (opens in a new tab)
Checked
October 3, 2026
Visit MITRE ATLAS (opens in a new tab)
Method or StandardI've used it
MITRE ATT&CK
The MITRE Corporation
A shared knowledge base of real-world attacker tactics and techniques for checking designs and controls against observed behavior.
Access
No cost
Fits
Security Architect, Solution Architect, Enterprise Architect
Details for MITRE ATT&CK
Use it when
You need a common language for how attackers actually operate.
Control investments should follow real adversary behavior.
Helps you produce
Threat models mapped to techniques
Detection and control coverage maps
Threat-informed control priorities
Think twice
Coverage of techniques is not proof of protection; don't present a heat map as evidence of security. (editorial)
Deployment
Not applicable
License
MITRE terms of use (notice required)
AI features
Not applicable
Edition
Version 19.2 (April 2026)
Experience
I've used it. Mike has used this in his own work.
Sources
MITRE ATT&CK (The MITRE Corporation) (opens in a new tab)
Version history (The MITRE Corporation) (opens in a new tab)
Terms of use (The MITRE Corporation) (opens in a new tab)
Checked
October 3, 2026
Visit MITRE ATT&CK (opens in a new tab)
Tool · Diagramming and WhiteboardingI've used it
Mural
Mural (Tactivos, Inc.)
An online whiteboard for facilitated workshops, brainstorming and team planning.
Access
Free tier (3 murals); paid per member
Fits
Business Architect, Enterprise Architect
Details for Mural
Use it when
You run discovery workshops with business stakeholders.
Ideas need to be captured before anything is modeled.
Helps you produce
Workshop boards
Process and swimlane sketches
Stakeholder maps
Think twice
It's built for workshops, not architecture modeling; treat boards as discovery notes, not the design of record. (editorial)
Deployment
Vendor-hosted (SaaS), Desktop app
License
Proprietary
AI features
Documents mind mapping, clustering, summarization and sentiment classification, run on Azure OpenAI.
Pricing model
Per member, with a free tier. Team+ US$9.99 and Business US$17.99 per member per month, billed yearly (as of October 3, 2026). Source: Pricing (opens in a new tab)
Experience
I've used it. Mike has used this in his own work.
Sources
Mural (Mural) (opens in a new tab)
Pricing (Mural) (opens in a new tab)
Mural AI (Mural) (opens in a new tab)
Checked
October 3, 2026
Visit Mural (opens in a new tab)
Method or StandardI've used it
NIST AI Risk Management Framework
NIST
NIST's voluntary framework for finding and managing AI risk through four functions: govern, map, measure and manage.
Access
No cost
Fits
AI Architect, Security Architect, Enterprise Architect
Details for NIST AI Risk Management Framework
Use it when
You need a recognized structure for AI risk decisions.
Generative AI use needs specific risk categories.
Helps you produce
AI risk registers
AI governance policies
Risk actions by function, with the Generative AI Profile
Think twice
It is voluntary and high-level, so you still have to turn it into controls. A revision is coming. (editorial)
Deployment
Not applicable
License
Not stated on reviewed pages
AI features
Not applicable
Edition
AI RMF 1.0 (2023) and Generative AI Profile (2024); revision underway
Experience
I've used it. Mike has used this in his own work.
Sources
AI Risk Management Framework (NIST) (opens in a new tab)
AI RMF 1.0 (NIST AI 100-1) (NIST) (opens in a new tab)
Generative AI Profile (NIST AI 600-1) (NIST) (opens in a new tab)
Checked
October 3, 2026
Visit NIST AI Risk Management Framework (opens in a new tab)
Method or StandardI've used it
NIST Cybersecurity Framework 2.0
NIST
NIST's taxonomy of cybersecurity outcomes under six functions (govern, identify, protect, detect, respond, recover) for setting posture and target state.
Access
No cost
Fits
Security Architect, Enterprise Architect
Details for NIST Cybersecurity Framework 2.0
Use it when
You need to describe security posture to leadership in one framework.
Several control catalogs must map to one set of outcomes.
Helps you produce
Current and target profiles
Gap analysis and action plans
Control crosswalks
Think twice
It describes outcomes, not controls; pair it with a control catalog before writing requirements. (editorial)
Deployment
Not applicable
License
Public NIST content; credit requested
AI features
Not applicable
Edition
CSF 2.0 (February 2024)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
Cybersecurity Framework (NIST) (opens in a new tab)
The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSRC) (opens in a new tab)
Checked
October 3, 2026
Visit NIST Cybersecurity Framework 2.0 (opens in a new tab)
Method or StandardI've used it
NIST SP 800-207 Zero Trust Architecture
NIST
NIST's vendor-neutral definition of zero trust: tenets, the policy engine and enforcement point model, deployment variations and migration steps.
Access
No cost
Fits
Security Architect, Enterprise Architect, Cloud and Platform Architect
Blueprint Catalog
Pattern: Zero Trust (opens in a new tab)
Details for NIST SP 800-207 Zero Trust Architecture
Use it when
You need a shared definition of zero trust before a vendor supplies one.
A network or identity redesign has to show where access decisions are made.
Helps you produce
Zero trust target architecture
Placement of policy decision and enforcement points
Migration plan away from perimeter-only controls
Think twice
Final since August 2020 with no revision; it defines the model, not a product set, so pair it with a maturity model and a control catalog. (editorial)
Deployment
Not applicable
License
Public NIST content; credit requested
AI features
Not applicable
Edition
SP 800-207 (August 2020)
Experience
I've used it. Mike has used this in his own work.
Sources
SP 800-207, Zero Trust Architecture (NIST CSRC) (opens in a new tab)
Copyright, fair use and licensing statements (NIST) (opens in a new tab)
Checked
October 10, 2026
Visit NIST SP 800-207 Zero Trust Architecture (opens in a new tab)
Tool · EA PlatformsUsed it in 2012
Orbus iServer and OrbusInfinity
Orbus Software
Orbus's architecture repository: iServer is the self-hosted, Visio-based product and OrbusInfinity is the current SaaS platform.
Access
Commercial; quote only
Fits
Enterprise Architect, Business Architect, Solution Architect
Details for Orbus iServer and OrbusInfinity
Use it when
Your organization models in Visio and Microsoft 365.
You need a governed repository with many viewers and few authors.
Helps you produce
TOGAF, ArchiMate and UML models
Impact analysis
Generated documents and Power BI reports
Think twice
Hosted iServer ended on 31 December 2024; new buyers get OrbusInfinity, so check which product a reference is about. (editorial)
Deployment
Self-hosted, Vendor-hosted (SaaS)
License
Proprietary
AI features
OrbusInfinity documents the O.ai assistant, an O.ai agent network, AI dashboards and AI-enabled automation.
Edition
iServer (self-hosted) and OrbusInfinity (SaaS, including a Government edition)
Pricing model
Quote only; unlimited viewers, priced by authors, contributors, integrations and support tier. Source: OrbusInfinity pricing (opens in a new tab)
Industry recognition
Orbus Software says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools (for OrbusInfinity). Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Experience
Used it in 2012. Mike has used this in his own work. See it on my Technology page.
Sources
iServer (Orbus Software) (opens in a new tab)
OrbusInfinity (Orbus Software) (opens in a new tab)
OrbusInfinity pricing (Orbus Software) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (Orbus Software) (opens in a new tab)
Checked
October 3, 2026
Visit Orbus iServer and OrbusInfinity (opens in a new tab)
Method or StandardI've used it
OWASP AI Exchange
OWASP Foundation
OWASP's open, in-depth guide to AI threats and controls across development, runtime, testing and privacy.
Access
No cost
Fits
AI Architect, Security Architect, Solution Architect
Details for OWASP AI Exchange
Use it when
You need controls, not just a list of risks, for an AI system.
An AI design review needs a deep reference.
Helps you produce
AI threat and control matrices
AI security requirements
Test plans
Think twice
It is a living document with no version numbers; record the date you used it. (editorial)
Deployment
Not applicable
License
CC0 1.0 (as stated on the site)
AI features
Not applicable
Experience
I've used it. Mike has used this in his own work.
Sources
OWASP AI Exchange (OWASP) (opens in a new tab)
AI security overview (OWASP) (opens in a new tab)
Checked
October 3, 2026
Visit OWASP AI Exchange (opens in a new tab)
Method or StandardI've used it
OWASP ASVS
OWASP Foundation
OWASP's tiered catalog of testable security requirements for web applications and APIs.
Access
No cost
Fits
Security Architect, Software Architect, Solution Architect
Details for OWASP ASVS
Use it when
Security needs to be written as testable requirements.
A penetration test or vendor review needs a defined scope.
Helps you produce
Security requirements baselines
Design review and verification checklists
Test and vendor scope
Think twice
Version 5.0 renumbered requirements from 4.0.3; pin the version in every reference. (editorial)
Deployment
Not applicable
License
CC BY-SA 4.0
AI features
Not applicable
Edition
Version 5.0.0
Experience
I've used it. Mike has used this in his own work.
Sources
Application Security Verification Standard (OWASP) (opens in a new tab)
LICENSE.md (OWASP ASVS on GitHub) (opens in a new tab)
Checked
October 3, 2026
Visit OWASP ASVS (opens in a new tab)
Tool · Security ToolsResearched
OWASP Threat Dragon
OWASP Foundation
An open-source tool for drawing data flow diagrams and recording threats and mitigations against each element.
Access
No cost
Fits
Security Architect, Software Architect
Details for OWASP Threat Dragon
Use it when
You want a free, lightweight way to start threat modeling.
Threat models should live next to the code in a git repository.
Helps you produce
Threat models on data flow diagrams
Threat and mitigation lists (STRIDE, LINDDUN and others)
Think twice
It records threats but doesn't track remediation; plan how findings reach your backlog. (editorial)
Deployment
Desktop app, Self-hosted
License
Apache-2.0
AI features
Not found on reviewed pages
Edition
Version 2
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
OWASP Threat Dragon (OWASP) (opens in a new tab)
Threat Dragon documentation (OWASP) (opens in a new tab)
license.txt (OWASP on GitHub) (opens in a new tab)
Checked
October 3, 2026
Visit OWASP Threat Dragon (opens in a new tab)
Method or StandardI've used it
OWASP Threat Modeling
OWASP Foundation
OWASP's practical guidance for finding, ranking and addressing security design threats early.
Access
No cost
Fits
Security Architect, Software Architect, Solution Architect
Details for OWASP Threat Modeling
Use it when
A new design or a major change needs a security review.
Teams need a repeatable way to ask what can go wrong.
Helps you produce
Data flow diagrams with trust boundaries
Threat lists (for example STRIDE)
Mitigations written as security requirements
Think twice
It is a practice, not a tool; it works when repeated with the right people in the room. (editorial)
Deployment
Not applicable
License
CC BY-SA 4.0
AI features
Not applicable
Experience
I've used it. Mike has used this in his own work.
Sources
Threat Modeling Cheat Sheet (OWASP Cheat Sheet Series) (opens in a new tab)
Threat Modeling (OWASP Community) (opens in a new tab)
Checked
October 3, 2026
Visit OWASP Threat Modeling (opens in a new tab)
Method or StandardI've used it
OWASP Top 10 for LLM Applications
OWASP GenAI Security Project
A community list of the most critical security risks in applications built on large language models, with mitigations.
Access
No cost
Fits
AI Architect, Security Architect, Software Architect
Details for OWASP Top 10 for LLM Applications
Use it when
You are adding an LLM feature and need a security baseline.
An AI design review needs common names for risks.
Helps you produce
LLM threat checklists
Security requirements for AI features
Design review and red-team scope
Think twice
It is an awareness list, not a control framework, and it changes yearly; pin the edition. (editorial)
Deployment
Not applicable
License
CC BY-SA 4.0
AI features
Not applicable
Edition
2026 edition
Experience
I've used it. Mike has used this in his own work.
Sources
LLM Top 10 (OWASP GenAI Security Project) (opens in a new tab)
LLM Top 10 2026 (OWASP GenAI Security Project) (opens in a new tab)
Checked
October 3, 2026
Visit OWASP Top 10 for LLM Applications (opens in a new tab)
Method or StandardI've used it
SABSA
The SABSA Institute
A business-driven method for enterprise security architecture: a layered matrix, a business attributes profile and traceability from strategy to operations.
Access
General-release papers free; membership £50 a year; training through accredited providers
Fits
Security Architect, Enterprise Architect
Details for SABSA
Use it when
Security requirements have to trace back to business goals, not just to a control list.
You want security architecture that speaks the same layers as the enterprise architecture.
Helps you produce
SABSA Matrix and Service Management Matrix
Business Attributes Profile
Security services catalogue and traceability model
Think twice
The general-release papers are free, but the full method sits in a commercial book and accredited courses; the licence is revocable and bars training use without consent. The core matrices were last revised in 2018. (editorial)
Deployment
Not applicable
License
Limited Open Source Licence (revocable; internal use free with attribution)
AI features
Not applicable
Edition
Matrices 2018 release; Principles paper January 2026
Pricing model
General-release white papers at no cost; General or Chartered membership £50 a year; course and exam fees set by accredited education providers. Source: Membership benefits (opens in a new tab)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
The SABSA Institute (The SABSA Institute) (opens in a new tab)
Resources index (The SABSA Institute) (opens in a new tab)
Limited Open Source Licence (The SABSA Institute) (opens in a new tab)
Membership benefits (The SABSA Institute) (opens in a new tab)
Certification (The SABSA Institute) (opens in a new tab)
Checked
October 10, 2026
Visit SABSA (opens in a new tab)
Tool · EA PlatformsI've used it
SAP LeanIX
SAP
A SaaS inventory of applications, capabilities and technology for assessing the portfolio and planning change.
Access
Commercial subscription, priced per application
Fits
Enterprise Architect, Business Architect
Details for SAP LeanIX
Use it when
You need a governed application inventory shared across the business.
Technology obsolescence and roadmaps are recurring questions.
Helps you produce
Application fact sheets and portfolio assessments
Business capability maps
Technology risk and roadmap views
Think twice
Pricing is per application, so agree on what counts as an application before you load data. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents an enterprise architecture assistant, Joule in SAP LeanIX, an inventory builder and an MCP server.
Pricing model
Per application in tiers, with no user limit; quote only. Source: Pricing (opens in a new tab)
Industry recognition
SAP says “a Leader” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 16, 2025 (opens in a new tab) Gartner note
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
Enterprise architecture (SAP LeanIX) (opens in a new tab)
Pricing (SAP LeanIX) (opens in a new tab)
AI in SAP LeanIX (SAP LeanIX) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (SAP) (opens in a new tab)
Checked
October 3, 2026
Visit SAP LeanIX (opens in a new tab)
Tool · EA PlatformsI've used it
ServiceNow Enterprise Architecture
ServiceNow
ServiceNow's architecture workspace (formerly Application Portfolio Management), linking applications, capabilities and technology to strategy.
Access
Commercial; needs a ServiceNow licence
Fits
Enterprise Architect, Business Architect
Blueprint Catalog
Product: ServiceNow (opens in a new tab)
Details for ServiceNow Enterprise Architecture
Use it when
Your CMDB and service data already live in ServiceNow.
You want portfolio decisions next to the operational records they depend on.
Helps you produce
Application portfolios and assessments
Business capability maps
Technology roadmaps
Architecture diagrams and BPMN models
Think twice
AI features ship as separate Store apps with unpublished SKUs; confirm entitlements with ServiceNow before counting on them. (editorial)
Deployment
Vendor-hosted (SaaS)
License
Proprietary
AI features
Documents Now Assist for Enterprise Architecture (also listed as Otto for EA), text-to-diagram, an EA Query Agent and an Architecture Analyzer (Australia release, 2026).
Edition
Australia release (2026)
Pricing model
Quote only; part of a ServiceNow subscription. Source: Enterprise Architecture (opens in a new tab)
Experience
Mike has used this in his own work. See it on my Technology page.
On this site
The Missing Middle: Why Business Apps Shouldn't Point at Servers
Sources
Enterprise Architecture (ServiceNow) (opens in a new tab)
Enterprise Architecture release notes (ServiceNow Docs) (opens in a new tab)
Enterprise Architecture: March 2026 Australia release (ServiceNow staff post) (ServiceNow Community) (opens in a new tab)
Checked
October 3, 2026
Visit ServiceNow Enterprise Architecture (opens in a new tab)
LearningResearched
Software Architecture Books (curated list)
mhadidg (GitHub)
A community list of about 107 software architecture books in 12 sections, chosen by Goodreads rating and review thresholds and sorted by review count.
Access
No cost
Fits
Software Architect, Solution Architect
Details for Software Architecture Books (curated list)
Use it when
You want the field's most-discussed books by topic before choosing two or three.
You are building a reading list for a team and need more than one person's picks.
Helps you produce
A shortlist of books per topic
A team reading plan
Think twice
Unchanged since October 2021 and sorted by popularity, not judgement; the ratings are a 2021 snapshot and every link goes to Goodreads. (editorial)
Deployment
Not applicable
License
CC BY 4.0
AI features
Not applicable
Edition
Last updated October 2021
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
software-architecture-books (mhadidg on GitHub) (opens in a new tab)
Commit history (mhadidg on GitHub) (opens in a new tab)
Checked
October 10, 2026
Visit Software Architecture Books (curated list) (opens in a new tab)
LearningResearched
Software Architecture Monday
Mark Richards
Free short video lessons on software architecture topics and the soft skills of the role, with a new one each month.
Access
No cost
Fits
Software Architect, Solution Architect
Details for Software Architecture Monday
Use it when
You are moving from developer to architect.
You want a short lesson on one pattern or trade-off.
Helps you produce
Pattern choices and trade-off analysis
Migration approaches
Think twice
Short lessons from one practitioner: a starting point, not a reference. (editorial)
Deployment
Not applicable
License
Not stated
AI features
Not applicable
Edition
Monthly; 223 lessons as of September 2026
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
Software Architecture Monday (DeveloperToArchitect (Mark Richards)) (opens in a new tab)
Checked
October 3, 2026
Visit Software Architecture Monday (opens in a new tab)
Tool · ModelingResearched
Sparx Enterprise Architect
Sparx Systems
A full modeling environment for UML, SysML, BPMN, ArchiMate and data models, from single users to shared team repositories.
Access
Commercial license; 30-day trial
Fits
Enterprise Architect, Solution Architect, Data Architect
Details for Sparx Enterprise Architect
Use it when
You need many notations in one repository, traced to each other.
Models must be shared by a team with controlled access.
Helps you produce
UML, SysML and BPMN models
ArchiMate views
Database models and generated DDL
Requirements traceability
Think twice
Choose the repository before the edition; the entry edition can't use a shared database repository. (editorial)
Deployment
Desktop app, Self-hosted, Vendor-hosted (SaaS)
License
Proprietary
AI features
Kernaro AI, sold separately, adds natural-language model editing and an assistant.
Edition
Professional, Corporate, Unified and Ultimate; SaaS editions
Pricing model
Per licence (standard or floating); published list prices. US$245 (Professional) to US$750 (Ultimate) per standard licence, version 17.2 (as of October 3, 2026). Source: Purchase (opens in a new tab)
Industry recognition
Sparx Systems says “positioned (no quadrant stated)” in the 2025 Gartner Magic Quadrant for Enterprise Architecture Tools. Vendor announcement, October 8, 2025 (opens in a new tab) Gartner note
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
Enterprise Architect (Sparx Systems) (opens in a new tab)
Compare editions (Sparx Systems) (opens in a new tab)
Enterprise Architect SaaS (Sparx Systems) (opens in a new tab)
Kernaro AI (Sparx Systems) (opens in a new tab)
Purchase (Sparx Systems) (opens in a new tab)
2025 Gartner Magic Quadrant announcement (Sparx Systems) (opens in a new tab)
Checked
October 3, 2026
Visit Sparx Enterprise Architect (opens in a new tab)
Tool · ModelingResearched
Structurizr
Structurizr (Simon Brown)
Diagrams as code: define one software architecture model in text and generate consistent C4 views from it.
Access
Open tools cost nothing; the prebuilt server needs a license
Fits
Solution Architect, Software Architect
Details for Structurizr
Use it when
Architecture views should be versioned and reviewed like code.
Several diagrams must stay consistent with one model.
Helps you produce
C4 context, container, component and deployment views
PlantUML and Mermaid exports
Think twice
Guides that mention Lite or the cloud plan are out of date; access control needs the licensed server. (editorial)
Deployment
Desktop app, Self-hosted
License
Apache-2.0 core; licensed prebuilt server
AI features
Documents DSL generation and an MCP server.
Edition
Local and server; the cloud service and Lite reached end of life
Pricing model
Open tools free; licence for the prebuilt server. Source: Server pricing (opens in a new tab)
Experience
Public documentation reviewed. Not a claim of personal use.
Sources
Structurizr (Structurizr) (opens in a new tab)
End of life (Structurizr) (opens in a new tab)
AI (Structurizr) (opens in a new tab)
LICENSE (Structurizr on GitHub) (opens in a new tab)
Server pricing (Structurizr) (opens in a new tab)
Checked
October 3, 2026
Visit Structurizr (opens in a new tab)
Method or StandardI've used it
TOGAF Standard
The Open Group
The Open Group's framework and method for setting up and running an enterprise architecture practice.
Access
Free for non-commercial use, with registration; consultancy needs a commercial license
Fits
Enterprise Architect, Business Architect
Details for TOGAF Standard
Use it when
You are setting up or maturing an architecture practice.
Architects need a shared method vocabulary.
Helps you produce
Architecture vision and target states
Gap analysis and roadmaps
Architecture governance artifacts
Think twice
Broad and heavy, so tailor it; consultancy for clients counts as commercial use. (editorial)
Deployment
Not applicable
License
Open Group license
AI features
Not applicable
Edition
10th Edition (2022)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
The TOGAF Standard (The Open Group) (opens in a new tab)
TOGAF Standard, 10th Edition non-commercial license (The Open Group) (opens in a new tab)
Checked
October 3, 2026
Visit TOGAF Standard (opens in a new tab)
Method or StandardI've used it
Zachman Framework
Zachman International
John Zachman's 6×6 ontology that classifies an enterprise's descriptions by question (what, how, where, who, when, why) and by perspective, scope to instance.
Access
Framework graphic free with an account; training and certification priced per course
Fits
Enterprise Architect, Business Architect
Details for Zachman Framework
Use it when
You need to see which descriptions of the enterprise exist, which are missing and which contradict each other.
A method such as TOGAF needs a classification scheme behind its deliverables.
Helps you produce
A classified inventory of existing architecture models
Primitive models per cell (data, process, network and so on)
A gap view of which cells have no owner or model
Think twice
It is a classification, not a method: it gives no sequence or process. The framework graphic is free for personal use after registering, but it may not be republished without written permission. (editorial)
Deployment
Not applicable
License
Copyright; personal use only, graphic reuse by written permission
AI features
Not applicable
Edition
Version 3.0 (2011)
Pricing model
Framework graphic at no cost after registering on zachman.com; training and Zachman Certified Enterprise Architect courses are priced per course, with a $99 renewal every three years. Source: Certification renewal information (opens in a new tab)
Experience
Mike has used this in his own work. See it on my Technology page.
Sources
Zachman International (Zachman International) (opens in a new tab)
About the Zachman Framework (Zachman International – FEAC Institute) (opens in a new tab)
The Zachman Framework Evolution (Zachman International) (opens in a new tab)
Zachman International FAQs (copyright and reprint rules) (Zachman International) (opens in a new tab)
Checked
October 10, 2026
Visit Zachman Framework (opens in a new tab)

Before You Adopt a Tool

Eight questions for any of the resources above, or any that are not on this page.

What decision and what artifact must it support?
Which information is authoritative here, and who maintains it?
Can objects and relationships be reused across views, or is each diagram separate?
How do review, collaboration and versioning work for a team like ours?
What can we export, in what format, and how much is lost?
Where does our data go, and what changes when AI features are switched on?
What licensing, maintenance and adoption effort comes with it?
How will we test its value on a small, real example first?

This is a starting point for a conversation, not a procurement, security or compliance review. The Technology Intake Checklist diagram shows where these questions sit in an intake process.

How This Guide Works

Every fact on a card (access, license, deployment, edition, AI features) was checked against the publisher's own pages on the date shown, and each card lists those sources. Tools are rechecked every 90 days and methods every 180; anything past its date is marked Review due. Where something couldn't be confirmed, the card says so rather than guessing.

“Use it when”, “Think twice” and the role guides are my own editorial judgment. Each card also says how I know it: Built by Mike for my own tools, I've used it for platforms I have used in my work, and Researched for everything else, which means public documentation reviewed, not personal use.

Pricing shows how each product is sold, from the vendor's own pages; list prices appear only where the vendor publishes them, with the date checked. Nothing on this page is sponsored, and no vendor paid to be listed.

Gartner note. Industry recognition is quoted from each vendor's own public announcement and linked to it; it never affects the order of this page. Gartner doesn't endorse any vendor, product or service in its research, and its research is the opinion of its analysts, not statements of fact. Gartner and Magic Quadrant are registered trademarks of Gartner, Inc. This site has no affiliation with Gartner.

Spotted something out of date or wrong? Tell me and I'll correct it.

What Is in the Guide

Start with Your Role

Where to Start

Reading

Resources for This Job

On This Site

Where to Start

Reading

Resources for This Job

On This Site

Where to Start

Reading

Resources for This Job

On This Site

Where to Start

Reading

Resources for This Job

Where to Start

Reading

Resources for This Job

On This Site

Where to Start

Reading

Resources for This Job

On This Site

Where to Start

Reading

Resources for This Job

On This Site

Where to Start

Reading

Resources for This Job

On This Site

Resources

Compare Tools

Archi

ArchiMate

Architecture Decision Records

ArchUnit

ArcKit

Ardoq

AWS Well-Architected Framework

Azure Well-Architected Framework

BIAN Service Landscape

BIZBOK Guide

Bizzdesign Alfabet

Bizzdesign Hopex

Bizzdesign Horizzon

Blueprint Modeler

BPMN

C4 model

CISA Zero Trust Maturity Model

DAMA-DMBOK

draw.io

garak

Google Cloud Well-Architected Framework

IriusRisk Community Edition

ISO/IEC 42001

Lucidchart

Microsoft Visio

Miro

MITRE ATLAS

MITRE ATT&CK

Mural

NIST AI Risk Management Framework

NIST Cybersecurity Framework 2.0

NIST SP 800-207 Zero Trust Architecture

Orbus iServer and OrbusInfinity

OWASP AI Exchange

OWASP ASVS

OWASP Threat Dragon

OWASP Threat Modeling

OWASP Top 10 for LLM Applications

SABSA

SAP LeanIX

ServiceNow Enterprise Architecture

Software Architecture Books (curated list)

Software Architecture Monday

Sparx Enterprise Architect

Structurizr