FossID Workbench vs OpenHack Supply Chain
FossID Workbench
fossid.com
OpenHack Supply Chain
openhack.comSide by side
| Figure | FossID Workbench | OpenHack Supply Chain |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Software Composition Analysis Software | 8.2 (#12) | 7.6 (#41) |
| Intended users | FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. | The product page describes reports for security reviewers and enterprise buyers, while the pricing page presents plans for startups and enterprises. |
| Purpose | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. | OpenHack Supply Chain combines software composition analysis and supply chain intelligence to find vulnerable dependencies and identify malicious dependencies. |
| SBOM | Workbench can create SBOMs with component, license, vulnerability, and usage information and export them in SPDX or CycloneDX formats. | It exports dependency inventories as CycloneDX 1.5 JSON, including package names, resolved versions, available license information, and dependency relationships. |
| Support | FossID directs customers to its support portal for help and ticket submission. | Enterprise pricing lists guided onboarding, dedicated customer success, a custom SLA, and priority phone and email support. |
Plans
OpenHack Supply Chain
- Free (Pay as you go)Free
- EnterprisePriced on request
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.
OpenHack Supply Chain
OpenHack Supply Chain has no write-up on Specifiction yet; its figures are above.