FossID Workbench vs Sandworm Audit
FossID Workbench
fossid.com
Sandworm Audit
sandworm.devSide by side
| Figure | FossID Workbench | Sandworm Audit |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Software Composition Analysis Software | 8.2 (#12) | 7.2 (#52) |
| Intended users | FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. | The homepage describes it for auditing JavaScript and PHP dependencies, with CLI use in terminal, CI, and Git hook workflows. |
| Purpose | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. | Sandworm Audit scans a project and its dependencies for vulnerabilities, license issues, and metadata issues. |
| Support | FossID directs customers to its support portal for help and ticket submission. | The documentation directs support questions and feature requests to GitHub discussions and bug reports to GitHub issues. |
Plans
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.
Sandworm Audit
Sandworm Audit has no write-up on Specifiction yet; its figures are above.