ManageEngine Vulnerability Manager Plus From $57.92/mo · Free plan 9.2 Visit OWASP DevGuard
owasp.github.io
Spec sheet
- Purpose
- DevGuard manages vulnerabilities across source code, dependencies, container images, infrastructure-as-code and deployed artifacts.Read 7 Oct 2026 · owasp.github.io
- Intended users
- DevGuard identifies developers, DevOps engineers and security teams as its intended users, and says specialized security knowledge is not required.Read 7 Oct 2026 · owasp.github.io
- Deployment
- The platform is self-hostable using Kubernetes or Docker Compose and provides a backend API and web UI.Read 7 Oct 2026 · docs.devguard.org
- Integrations
- It lists GitHub Issues, GitLab Issues and Jira for bidirectional issue synchronization, including slash-command triage.Read 7 Oct 2026 · owasp.github.io
- Support
- The project directs community users to its Matrix space and monthly community call.Read 7 Oct 2026 · owasp.github.io
- License
- DevGuard's source code is distributed under the AGPL-3.0-or-later license.Read 7 Oct 2026 · docs.devguard.org
- Headquarters
- Bonn, GermanyRead 28 Sep 2026 · owasp.github.io
- Maker
- The DevGuard site identifies L3montree GmbH and the DevGuard Contributors in its copyright notice.Read 7 Oct 2026 · devguard.org
- Dependency firewall
- The dependency proxy supports npm, Go and PyPI and blocks packages flagged in the OSSF malicious packages database.Read 7 Oct 2026 · docs.devguard.org
- Risk prioritization
- DevGuard scores findings using CVSS-BE, EPSS and component depth to prioritize risks.Read 7 Oct 2026 · owasp.github.io
- SBOM and VEX
- It supports CycloneDX SBOMs, VEX workflows and live SBOM and VEX endpoints.Read 7 Oct 2026 · owasp.github.io
- Scanner imports
- DevGuard can ingest CycloneDX SBOM and SARIF data from Trivy, Grype, Semgrep and other standards-compliant tools.Read 7 Oct 2026 · owasp.github.io
- Scanner platforms
- The standalone scanner supports Linux, macOS and Windows.Read 7 Oct 2026 · docs.devguard.org
- Scanning
- Its security pipeline covers secret scanning, SAST, SCA, IaC scanning, container scanning and license compliance.Read 7 Oct 2026 · owasp.github.io
- Security and compliance
- The project describes in-toto attestations, SLSA provenance, cosign signatures and automated evidence for ISO 27001, CRA, BSI IT-Grundschutz and SLSA.Read 7 Oct 2026 · owasp.github.io
Plans and prices
Open Source Free Free for public projects with OSI-approved license · all features · community support · self-hosted Read 7 Oct 2026 · devguard.org
SaaS €449.10 a month 1 year contract, paid yearly Starting at · 10 user seats included · fully managed hosting in Germany · initial 1-hour setup workshop · 8×5 email support Read 7 Oct 2026 · devguard.org
Enterprise Priced on request Annual subscription; plus one-time initial setup Self-hosted · 20 to 160 support hours per year · contractual response times of 16 h, 8 h or 4 h Read 7 Oct 2026 · devguard.org
Where Specifiction places it
- Vulnerability Management Software#6 of 338.4
Alternatives to OWASP DevGuardAll alternatives →
ManageEngine Vulnerability Manager Plus From $57.92/mo · Free plan 9.2 Visit 
OWASP DefectDojo From $100/mo · Free plan 8.9 Visit 
Intruder Free plan 8.8 Visit 
UpGuard From $1,750/mo · Free plan 8.7 Visit 
Holm Security Vulnerability Management 8.1 Visit