FOSSA vs SBOM Workbench
FOSSA
fossa.comSBOM Workbench
scanoss.readthedocs.ioSide by side
| Figure | FOSSA | SBOM Workbench |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 3 | 1 |
| Spec score · Open Source License Compliance Software | 8.1 (#8) | 7.5 (#22) |
| Headquarters | San Francisco, California, United States | Madrid, Spain |
| Integrations | Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. | The maker lists pre-commit hooks, Actions, pipelines and webhooks among its integrations; Bitbucket is marked coming soon. |
| Intended users | FOSSA describes its documentation as serving developers, security teams, and legal counsel. | The maker describes the Workbench as a developer-oriented graphical tool for scanning and auditing source code. |
| Purpose | FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle. | SBOM Workbench is a graphical interface for scanning and auditing source code using the SCANOSS API. |
| Support | The Free plan includes basic email support, while Business includes priority support. | SCANOSS directs users to contact its support team by email at [email protected]. |
Plans
In their own words
FOSSA
FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.
SBOM Workbench
SBOM Workbench is a graphical tool for scanning and auditing source code through the SCANOSS API. It identifies open-source components, including undeclared code that may not appear in dependency manifests, and the free version identifies licenses and security vulnerabilities. It generates SPDX-Lite software bills of materials; release notes also list CycloneDX, SPDX Lite, CSV, and HTML exports. The tool is aimed at developers and runs on Linux, macOS, and Windows. Its CLI can use multiple SCANOSS API endpoints, including custom servers. Listed integrations include pre-commit hooks, Actions, pipelines, and webhooks, while Bitbucket is marked as coming soon. Repository documentation describes a collaborative workspace. The distributed software is described by SCANOSS as open source, and the Workbench has a public GitHub repository. Cryptographic algorithm identification is a premium feature, not included in the free Workbench. It is free to download, and SCANOSS directs support requests to email. Paid SCANOSS subscription prices listed for other offerings are not Workbench prices.