FOSSA vs OTNOS SBOM 360

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.

OTNOS SBOM 360 helps operational technology manufacturers analyze, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and can produce CycloneDX VEX, OpenVEX and SBOMs containing embedded VEX. A read-only GitHub app links repositories to products and refreshes SBOMs after default-branch pushes and nightly checks. OTNOS mirrors more than 400,000 vulnerability advisories, syncs them daily and queries locally without sending component names outside the tenant. Findings include severity, EPSS, installed and fixed versions, CISA KEV status and EUVD identifiers. Users can record whether a finding is affected, not affected, fixed or under investigation, with supporting rationale and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for Article 14 reports and supports configurable alerts for new advisories, fixes, KEV listings and rising EPSS scores. Application and database data run in Germany; files and backups remain in EU regions. The Free plan costs $0/forever; Professional and Enterprise pricing is custom.