FOSSA vs OWASP Dependency-Track
FOSSA
fossa.com
OWASP Dependency-Track
dependencytrack.orgSide by side
| Figure | FOSSA | OWASP Dependency-Track |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 3 | 1 |
| Spec score · Software Composition Analysis Software | 8.0 (#20) | 7.6 (#42) |
| Spec score · Dependency Management Software | 8.1 (#10) | 7.6 (#18) |
| Spec score · SBOM Management Software | 8.0 (#9) | 7.7 (#11) |
| Deployment | FOSSA documents an on-premises deployment that customers can operate in their own infrastructure using Kubernetes and Helm. | Version 5.1 is distributed as separate API server and frontend container images, and Kubernetes is supported. |
| Founded | 2015 | 2013 |
| Integrations | Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. | Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields. |
| Intended users | FOSSA describes its documentation as serving developers, security teams, and legal counsel. | The platform is described as serving organizations from a single team to enterprise portfolios of hundreds of thousands of projects. |
| Purpose | FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle. | Dependency-Track inventories software components from SBOMs, identifies vulnerabilities, and helps enforce policy across the software supply chain. |
Plans
In their own words
FOSSA
FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.
OWASP Dependency-Track
OWASP Dependency-Track is a free, self-hosted platform for managing software-component risk across a supply chain. It builds inventories from software bills of materials and identifies vulnerable components, supporting CycloneDX SBOM, HBOM, VEX, and VDR documents for ingestion, analysis, and production. Components can be matched against NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB, while integrated EPSS support helps prioritize mitigation. Integrity checks flag components when published hashes differ from those served by an upstream registry. A Common Expression Language policy engine evaluates component rules and can break a build when a policy fails. Alerts can be filtered by event fields and sent to Slack, Teams, Mattermost, email, or webhooks. API and web interfaces are available, with least-privilege portfolio access and single sign-on through OpenID Connect, Active Directory, and LDAP. Version 5.1 uses separate API and frontend container images, supports Kubernetes, and requires PostgreSQL.