CAST SBOM Manager vs TRUSCA
CAST SBOM Manager
castsoftware.comTRUSCA
github.comSide by side
| Figure | CAST SBOM Manager | TRUSCA |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · SBOM Management Software | 8.0 (#8) | 7.3 (#16) |
| Intended users | The product is designed for software product owners, release managers, and compliance specialists. | The project describes the portal as serving engineering, legal, and security teams. |
| Purpose | CAST SBOM Manager automatically analyzes source code and creates Software Bills of Materials (SBOMs). | TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. |
| Support | CAST’s support site offers documentation, downloads, training, a community, knowledge base articles, FAQs, and troubleshooting resources. | The project says it has no paid support tier or managed hosting and directs users to its community support channels. |
Plans
In their own words
CAST SBOM Manager
CAST SBOM Manager analyzes source code and creates Software Bills of Materials for software product owners, release managers, and compliance specialists. SBOM creation can start from application code, existing files, Git repositories, or CAST Highlight results. A dashboard presents components, vulnerabilities, licenses, obsolescence, languages, topics, and file extensions. Users can define proprietary components with custom descriptions, licenses, vulnerabilities, copyrights, and programming languages, then place components in catalogs for reuse. License tools support custom definitions and management of open-source risks, requirements, obsolescence, and copyrights. Vulnerability information includes CVEs from NIST’s NVD and advisories from GitHub and GitLab, with custom vulnerabilities also supported. SBOMs can be imported from multiple formats and exported as Excel, Word, or CycloneDX. Multiple versions can be managed, and exported contents can be tailored for different audiences. The product runs on Linux and Windows with cloud or on-premises deployment. A free download is listed at free.
TRUSCA
TRUSCA is a free, open-source, self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. It uses cdxgen to detect packages across more than 30 language ecosystems, while Trivy matches components with NVD, OSV, GitHub Advisory, EPSS, and KEV data. Weekly database refreshes add new CVEs. TRUSCA imports CycloneDX or SPDX SBOMs and exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value. CI integrations include GitHub Actions, GitLab CI, Jenkins examples, a REST API, and API keys; build gates can fail on Critical CVEs or forbidden licenses. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and block forbidden licenses. The platform also offers approvals, an append-only audit log, email, Slack, Teams notifications, VEX triage, and EPSS prioritization. It runs through Docker Compose or Helm. It does not analyze users’ own source code.