Skip to content
SPECIFICTION
Get listed

FossID Workbench

fossid.com

WebLinuxAPISelf-hosted
Visit fossid.com
Spec score 8.2 #12 of 65 in Software Composition Analysis Software

What it is

FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.

Spec sheet

Purpose
FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases.Read 10 Oct 2026 · fossid.com
Product
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases.Read 9 Oct 2026 · fossid.com
Intended users
FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams.Read 9 Oct 2026 · fossid.com
Audience
FossID describes its customers as enterprise software teams and says its users span engineering, legal, compliance, and security roles.Read 10 Oct 2026 · fossid.com
Deployment
FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option.Read 10 Oct 2026 · fossid.com
API
The Workbench API supports custom workflows for scanning, gating, and notifying.Read 9 Oct 2026 · fossid.com
Integrations
Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications.Read 10 Oct 2026 · fossid.com
Support
FossID directs customers to its support portal for help and ticket submission.Read 10 Oct 2026 · fossid.com
Headquarters
Stockholm, SwedenRead 28 Sep 2026 · fossid.com
Founded
2016Read 28 Sep 2026 · fossid.com
Company
FossID says it was founded in 2016 and was reacquired by its founders in 2022 after being acquired by Snyk in 2021.Read 9 Oct 2026 · fossid.com
Access management
Workbench 26.2 added SAML single sign-on, working with user groups and SCIM synchronization.Read 10 Oct 2026 · fossid.com
Code detection
Its scanning identifies open-source code snippets, including snippets as small as six lines, and is designed to detect code despite modifications.Read 10 Oct 2026 · fossid.com
Dependency analysis
Workbench identifies direct and transitive dependencies from supported package manifests, while source scanning can find unmanaged code.Read 10 Oct 2026 · fossid.com
Detection
It analyzes dependencies, scans unmanaged source code regardless of programming language, and detects open-source snippets embedded in source files.Read 9 Oct 2026 · fossid.com
Identification
ID Assist proposes component identifications, and License Extractor detects and extracts file-level license text.Read 9 Oct 2026 · fossid.com
M&A audits
FossID describes a blind audit process that creates a one-way hash and does not require access to the target’s source code.Read 9 Oct 2026 · fossid.com
Policy controls
Policy management can enforce license, security, and software usage rules across projects.Read 10 Oct 2026 · fossid.com
Policy management
Policy Management can automatically enforce license, security, and usage policies across projects.Read 9 Oct 2026 · fossid.com
SBOM
Workbench can create SBOMs with component, license, vulnerability, and usage information and export them in SPDX or CycloneDX formats.Read 9 Oct 2026 · fossid.com
SBOMs
Workbench supports creating, importing, consolidating, and exporting SBOMs in SPDX and CycloneDX formats.Read 10 Oct 2026 · fossid.com
Security certifications
FossID announced ISO/IEC 27001 information security management and ISO 9001 quality management certifications in 2024.Read 10 Oct 2026 · fossid.com
Source confidentiality
FossID says its fingerprint-based scanning sends hash values rather than source code, which remains in the client environment.Read 10 Oct 2026 · fossid.com
Vulnerability review
Workbench provides vulnerability triage and VEX authoring, with CVE details including CVSS data, EPSS scores, and CISA KEV indicators in version 26.2.Read 10 Oct 2026 · fossid.com

Plans and prices

FossID Workbench Priced on request Pricing not stated; contact FossID for a quote Read 10 Oct 2026 · fossid.com

Every FossID Workbench plan and price →

Strong points and limits

Strong points

  • Detects dependencies and unmanaged source code
  • Generates SPDX and CycloneDX SBOMs
  • Finds vulnerable code linked to CVEs
  • Supports pull-request scanning and CI/CD gates
  • Cloud, hybrid, on-premises, and air-gapped options

Limits

  • Pricing is available only on request
  • Broad ecosystem support may require configuration
  • Product is aimed at enterprise software teams
  • No public price is listed

Who it suits

It suits engineering, DevSecOps, compliance, legal, and audit teams managing third-party code. Enterprise teams needing SBOMs, policy controls, vulnerability review, or private deployment are the stated audience.

Verdict

Workbench combines component identification, license extraction, vulnerability review, SBOM handling, and policy enforcement. Its deployment and integration choices fit organizations with formal software-governance workflows, but buyers must request a quote.

Where Specifiction places it

Alternatives to FossID WorkbenchAll alternatives →