CAST SBOM Manager vs Codenotary Trustcenter

CAST SBOM Manager analyzes source code and creates Software Bills of Materials for software product owners, release managers, and compliance specialists. SBOM creation can start from application code, existing files, Git repositories, or CAST Highlight results. A dashboard presents components, vulnerabilities, licenses, obsolescence, languages, topics, and file extensions. Users can define proprietary components with custom descriptions, licenses, vulnerabilities, copyrights, and programming languages, then place components in catalogs for reuse. License tools support custom definitions and management of open-source risks, requirements, obsolescence, and copyrights. Vulnerability information includes CVEs from NIST’s NVD and advisories from GitHub and GitLab, with custom vulnerabilities also supported. SBOMs can be imported from multiple formats and exported as Excel, Word, or CycloneDX. Multiple versions can be managed, and exported contents can be tailored for different audiences. The product runs on Linux and Windows with cloud or on-premises deployment. A free download is listed at free.

Codenotary Trustcenter manages software bills of materials (SBOMs) and applies trust enforcement to applications and their components. It can import and export SBOMs in any format, create detailed SBOMs for open-source applications or containers, and analyze them. The platform tracks component provenance and trust levels, flags unknown or untrusted components, and monitors attestations and application and stack risk profiles. It provides real-time application risk scores with reachability analysis and can enforce deployment of container images built with known, trusted components. Trustcenter also supports software risk profiles for compliance and audit work, plus artifact attestation guidance such as in-toto. Listed integrations include CI/CD and SCM tools, Docker and OCI registries, Snyk, Aqua, JFrog, Jenkins, GitLab, GitHub, Kubernetes, and AWS Lambda. Language bindings include Java, C++, Python, Node.js, Go, Rust, and PHP. Trustcenter/Teams is offered on-premises or in the cloud, with component discovery, dependency tracking, centralized SBOM storage, and continuous vulnerability scanning. Enterprise plans start at $3,600 a month; Teams pricing is by quote. A 30-day trial is listed.