FOSSA vs FossID Workbench
FOSSA
fossa.com
FossID Workbench
fossid.comSide by side
| Figure | FOSSA | FossID Workbench |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Open Source License Compliance Software | 8.1 (#8) | 8.2 (#6) |
| Spec score · Software Composition Analysis Software | 8.0 (#20) | 8.2 (#12) |
| Spec score · Dependency Management Software | 8.1 (#10) | 8.2 (#8) |
| Deployment | FOSSA documents an on-premises deployment that customers can operate in their own infrastructure using Kubernetes and Helm. | FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option. |
| Founded | 2015 | 2016 |
| Headquarters | San Francisco, California, United States | Stockholm, Sweden |
| Integrations | Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. | Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications. |
| Intended users | FOSSA describes its documentation as serving developers, security teams, and legal counsel. | FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. |
| Purpose | FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle. | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. |
| SBOMs | FOSSA supports generating, importing, exporting, and managing SBOMs; the pricing page lists a limit of five imported SBOMs on Free. | Workbench supports creating, importing, consolidating, and exporting SBOMs in SPDX and CycloneDX formats. |
| Support | The Free plan includes basic email support, while Business includes priority support. | FossID directs customers to its support portal for help and ticket submission. |
Plans
In their own words
FOSSA
FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.