Exodos Labs vs TRUSCA
Exodos Labs
exodoslabs.comTRUSCA
github.comSide by side
| Figure | Exodos Labs | TRUSCA |
|---|---|---|
| Price from | $29/mo | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 4 | 1 |
| Spec score · SBOM Management Software | 8.4 (#3) | 7.3 (#16) |
| Deployment | The architecture page lists cloud-hosted, private deployment, and hybrid deployment models. | TRUSCA is distributed for users to run themselves with Docker Compose or a Helm chart; a read-only live demo is also available. |
| Intended users | The maker says the platform is built for security, compliance, and engineering teams, including regulated suppliers and organizations operating in regulated environments. | The project describes the portal as serving engineering, legal, and security teams. |
| Purpose | Exodos Labs describes its platform as a system of record, exchange, and automation layer for managing, sharing, and operationalizing SBOMs across the software supply chain. | TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. |
| Support | The Community plan includes Community Support, Team includes support unspecified by tier, Professional includes Professional Support, and Enterprise includes Dedicated Support. | The project says it has no paid support tier or managed hosting and directs users to its community support channels. |
Plans
Exodos Labs
- CommunityFree
- Team$29 a month
- Professional$1,240 a month
- EnterprisePriced on request
In their own words
Exodos Labs
Exodos Labs manages, shares, and operationalizes software bills of materials (SBOMs) across the software supply chain. It ingests SBOMs from CI/CD pipelines, APIs, and suppliers, tracks them across builds, releases, and products, and applies validation and quality gates. Scans assess vulnerabilities, FOSS license and compliance issues, component health, and geopolitical supply-chain risks. The Community plan supports CycloneDX and SPDX formats. Secure Exchange provides access controls by organization, role, purpose, or time, alongside redaction, request workflows, and audit logs. Integrations include Cloudsmith, GitHub Actions, GitLab CI, Bitbucket Pipelines, custom build systems, vulnerability scanners, SIEM platforms, and risk management systems. Deployment options listed are cloud-hosted, private, and hybrid. Community costs nothing and includes one user and one API key. Team costs $29 a month, on annual contracts billed yearly; Professional costs $1,240 a month on annual contracts billed yearly. The platform is aimed at security, compliance, and engineering teams, including organizations in regulated environments.
TRUSCA
TRUSCA is a free, open-source, self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. It uses cdxgen to detect packages across more than 30 language ecosystems, while Trivy matches components with NVD, OSV, GitHub Advisory, EPSS, and KEV data. Weekly database refreshes add new CVEs. TRUSCA imports CycloneDX or SPDX SBOMs and exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value. CI integrations include GitHub Actions, GitLab CI, Jenkins examples, a REST API, and API keys; build gates can fail on Critical CVEs or forbidden licenses. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and block forbidden licenses. The platform also offers approvals, an append-only audit log, email, Slack, Teams notifications, VEX triage, and EPSS prioritization. It runs through Docker Compose or Helm. It does not analyze users’ own source code.