Skip to content
SPECIFICTION
Get listed

OTNOS SBOM 360

otnos.com

Free plan WebAPI
Visit otnos.com
Spec score 7.4 #15 of 22 in SBOM Management Software

What it is

OTNOS SBOM 360 helps operational technology manufacturers analyze, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and can produce CycloneDX VEX, OpenVEX and SBOMs containing embedded VEX. A read-only GitHub app links repositories to products and refreshes SBOMs after default-branch pushes and nightly checks. OTNOS mirrors more than 400,000 vulnerability advisories, syncs them daily and queries locally without sending component names outside the tenant. Findings include severity, EPSS, installed and fixed versions, CISA KEV status and EUVD identifiers. Users can record whether a finding is affected, not affected, fixed or under investigation, with supporting rationale and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for Article 14 reports and supports configurable alerts for new advisories, fixes, KEV listings and rising EPSS scores. Application and database data run in Germany; files and backups remain in EU regions. The Free plan costs $0/forever; Professional and Enterprise pricing is custom.

Spec sheet

Purpose
SBOM 360 ingests, analyzes, assesses, monitors and reports software products for OT manufacturers responding to the Cyber Resilience Act.Read 1 Oct 2026 · otnos.com
Audience
OTNOS says it works with OT security engineers, PSIRT and vulnerability-management teams, consultants and MSSPs across energy, manufacturing, water and building technology.Read 1 Oct 2026 · otnos.com
Integrations
Listed integrations and data sources include GitHub, OSV, GitHub Advisories, CISA KEV, FIRST EPSS, ENISA EUVD, endoflife.date, Microsoft Power Automate, webhooks, REST API and MCP for AI agents.Read 1 Oct 2026 · otnos.com
Compliance posture
OTNOS is CSA STAR Level 1 listed, GDPR-aligned with a DPA available, and operates an ISO/IEC 27001:2022 ISMS while formal certification is planned.Read 1 Oct 2026 · otnos.com
CRA reporting
OTNOS drafts all 39 ENISA Single Reporting Platform fields for 24-hour, 72-hour and final Article 14 reports.Read 1 Oct 2026 · otnos.com
GitHub connector
A read-only GitHub app maps repositories to products and updates SBOMs on default-branch pushes and nightly checks.Read 1 Oct 2026 · otnos.com
Monitoring alerts
Configurable triggers cover new affecting advisories, newly available fixes, KEV listings and rising EPSS scores, with deduplicated email digests.Read 1 Oct 2026 · otnos.com
Risk analysis
Findings show EPSS beside severity, installed versions beside fixed versions, CISA KEV status and EUVD identifiers.Read 1 Oct 2026 · otnos.com
SBOM formats
The platform consumes CycloneDX and SPDX SBOMs and produces CycloneDX VEX, OpenVEX and SBOMs with embedded VEX.Read 1 Oct 2026 · otnos.com
Security hosting
Application and database data run in Germany, files and backups stay in EU regions, and data is encrypted in transit and at rest.Read 1 Oct 2026 · otnos.com
VEX workflow
Users can mark findings affected, not affected, fixed or under investigation with justifications, workarounds and decision history.Read 1 Oct 2026 · otnos.com
Vulnerability intelligence
OTNOS mirrors more than 400,000 advisories across ecosystems, synced daily and queried locally without sending component names outside the tenant.Read 1 Oct 2026 · otnos.com

Plans and prices

Free Free $0/forever 50 monitored assets · 1 user · 2 CSV imports/month · 1 saved CSV · max CSV 1 MB · daily monitoring · basic AI risk analysis · community support Read 1 Oct 2026 · otnos.com
Enterprise Priced on request Custom Custom assets and users · 100K API calls/month included · real-time monitoring · custom PCAP limits · dedicated support + SLA · advanced RBAC Read 1 Oct 2026 · otnos.com
Professional Priced on request Custom 1,000 monitored assets · up to 50 users · 50 CSV imports/month · 25 saved CSVs · max CSV 10 MB · 10K API calls/month · hourly monitoring · 50 PCAP analyses/month · priority support Read 1 Oct 2026 · otnos.com

Every OTNOS SBOM 360 plan and price →

Strong points and limits

Strong points

  • Accepts both CycloneDX and SPDX SBOMs
  • Mirrors over 400,000 advisories with daily syncing
  • Component names are queried locally
  • Drafts all 39 ENISA reporting fields
  • Free plan includes daily monitoring

Limits

  • Free plan is limited to 50 monitored assets
  • Free plan permits one user
  • Professional and Enterprise pricing is custom

Who it suits

SBOM 360 is for OT security engineers, PSIRT and vulnerability-management teams, consultants and MSSPs. Its stated sector audience includes energy, manufacturing, water and building technology.

Verdict

SBOM 360 brings SBOM handling, vulnerability review, VEX decisions and CRA reporting into a cloud platform. The free plan has clear asset and user limits, while higher-tier pricing requires a custom quote.

Where Specifiction places it

Alternatives to OTNOS SBOM 360All alternatives →