Skip to content
SPECIFICTION
Get listed

Ortelius

ortelius.io

From $40/mo Free plan WebAPISelf-hosted
Visit ortelius.io
Spec score 8.8 #1 of 22 in SBOM Management Software

What it is

Ortelius connects software inventory to deployment information so teams can trace packages and versions to the endpoints where they run. It accepts SPDX and CycloneDX SBOMs and can create an SBOM with Syft when one is missing. It checks inventory against OSV.dev for newly disclosed vulnerabilities every ten minutes, tracing affected packages through artifacts and deployments to endpoints. Its post-deployment security dashboard brings together project security signals, versioned SBOMs, live deployments and vulnerability detection, and correlates OpenSSF Scorecard results with deployed packages and versions. Ortelius describes the dashboard as continuously aligned with NIST 800-218 SSDF. The product is available as SaaS or on-premise/self-hosted software, with REST and GraphQL APIs protected by JWT middleware. A GitHub App supports installation connections and repository onboarding, but onboarding does not attach an SBOM. Ortelius OS Free costs nothing, with up to 5 components; DeployHub Enterprise costs $40 a month, billed $40 / component / month.

Spec sheet

Purpose
Ortelius maps SBOM packages and versions to artifacts, deployments, environments, and production endpoints.Read 1 Oct 2026 · ortelius.io
Support
Ortelius OS provides community technical support, while DeployHub Enterprise includes commercial technical support.Read 1 Oct 2026 · deployhub.com
Access controls
The free Ortelius offering has user-level access controls, while DeployHub adds group-level access controls and LDAP/Active Directory support.Read 1 Oct 2026 · deployhub.com
CI/CD integration
Ortelius uses its CLI in CI/CD pipelines to capture supply-chain data at build and deployment stages.Read 1 Oct 2026 · ortelius.io
Community support
Questions are supported through the Ortelius Discord channel and GitHub issues.Read 30 Sep 2026 · ortelius.io
Compliance dashboard
Ortelius provides a post-deployment security compliance dashboard connecting project security signals, versioned SBOMs, live deployments and vulnerability detection.Read 30 Sep 2026 · ortelius.io
CVE tracing
It traces a vulnerability from affected package and version through artifact, deployment and endpoint.Read 30 Sep 2026 · ortelius.io
Deployment options
Ortelius OS is offered as SaaS or on-premise/self-hosted software.Read 1 Oct 2026 · deployhub.com
Detection interval
Ortelius re-maps vulnerability intelligence against deployed SBOMs every ten minutes.Read 30 Sep 2026 · ortelius.io
Detection speed
Ortelius maps software inventory to newly disclosed vulnerabilities within 10 minutes of reporting.Read 1 Oct 2026 · ortelius.io
Digital twin
Ortelius uses a deployment-aware software digital twin to provide continuously updated visibility into deployed components and their security posture.Read 1 Oct 2026 · ortelius.io
Endpoint tracking
The platform tracks where software components are deployed so teams can identify affected systems.Read 1 Oct 2026 · deployhub.com
GitHub integration
The GitHub App imports repository releases and successful GitHub Actions workflow runs into Ortelius.Read 1 Oct 2026 · github.com
Governance
The project incubates at the Continuous Delivery Foundation, part of the Linux Foundation, under open governance.Read 1 Oct 2026 · ortelius.io
Hosted deployment
The project README identifies a hosted version at app.deployhub.com that requires no infrastructure setup.Read 30 Sep 2026 · github.com
NIST alignment
The security dashboard describes continuous alignment with NIST 800-218 SSDF.Read 30 Sep 2026 · ortelius.io
Onboarding limitation
GitHub onboarding imports release and deployment metadata but does not itself attach an SBOM.Read 30 Sep 2026 · github.com
OpenSSF Scorecard
It correlates OpenSSF Scorecard results with packages and versions deployed across environments.Read 30 Sep 2026 · ortelius.io
SaaS availability
The site offers a free SaaS version.Read 30 Sep 2026 · ortelius.io
SBOM formats
It consumes SPDX and CycloneDX SBOMs and can generate an SBOM with Syft when one does not exist.Read 1 Oct 2026 · ortelius.io
Self-hosting and API
The project documentation describes on-premises or self-hosted operation and REST and GraphQL API endpoints protected by JWT middleware.Read 30 Sep 2026 · ortelius.io
Vulnerability intelligence
Ortelius queries OSV.dev public APIs every 10 minutes for vulnerability checks.Read 1 Oct 2026 · ortelius.io
Vulnerability monitoring
It continuously evaluates software inventory against OSV.dev for newly disclosed vulnerabilities.Read 1 Oct 2026 · ortelius.io

Plans and prices

Ortelius OS Free Free Free up to 5 components · unlimited users · unlimited endpoint tracking · community support Read 1 Oct 2026 · deployhub.com
DeployHub Enterprise $40 a month $40 / component / month pay-as-you-grow component coverage · group-level access controls · SaaS or self-hosted · commercial support Read 1 Oct 2026 · deployhub.com

Every Ortelius plan and price →

Strong points and limits

Strong points

  • Accepts SPDX and CycloneDX SBOMs.
  • Checks OSV.dev every ten minutes.
  • Traces vulnerabilities through artifacts to endpoints.
  • Available as SaaS or self-hosted software.

Limits

  • GitHub onboarding does not attach an SBOM.
  • Free plan covers up to 5 components.
  • DeployHub Enterprise costs $40 / component / month.

Who it suits

Ortelius suits teams that need to connect SBOMs and deployment data to identify affected endpoints. It can be used as SaaS or self-hosted, with community support for Ortelius OS and commercial support for DeployHub Enterprise.

Verdict

Ortelius links software inventory to deployed components and gives teams a path from a vulnerability to affected endpoints. Its free tier has a five-component limit, while broader component coverage is billed per component.

Where Specifiction places it

Alternatives to OrteliusAll alternatives →