FossID Workbench vs SBOM Workbench
FossID Workbench
fossid.comSBOM Workbench
scanoss.readthedocs.ioSide by side
| Figure | FossID Workbench | SBOM Workbench |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Open Source License Compliance Software | 8.2 (#6) | 7.5 (#22) |
| Headquarters | Stockholm, Sweden | Madrid, Spain |
| Integrations | Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications. | The maker lists pre-commit hooks, Actions, pipelines and webhooks among its integrations; Bitbucket is marked coming soon. |
| Intended users | FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. | The maker describes the Workbench as a developer-oriented graphical tool for scanning and auditing source code. |
| Purpose | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. | SBOM Workbench is a graphical interface for scanning and auditing source code using the SCANOSS API. |
| Support | FossID directs customers to its support portal for help and ticket submission. | SCANOSS directs users to contact its support team by email at [email protected]. |
Plans
In their own words
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.
SBOM Workbench
SBOM Workbench is a graphical tool for scanning and auditing source code through the SCANOSS API. It identifies open-source components, including undeclared code that may not appear in dependency manifests, and the free version identifies licenses and security vulnerabilities. It generates SPDX-Lite software bills of materials; release notes also list CycloneDX, SPDX Lite, CSV, and HTML exports. The tool is aimed at developers and runs on Linux, macOS, and Windows. Its CLI can use multiple SCANOSS API endpoints, including custom servers. Listed integrations include pre-commit hooks, Actions, pipelines, and webhooks, while Bitbucket is marked as coming soon. Repository documentation describes a collaborative workspace. The distributed software is described by SCANOSS as open source, and the Workbench has a public GitHub repository. Cryptographic algorithm identification is a premium feature, not included in the free Workbench. It is free to download, and SCANOSS directs support requests to email. Paid SCANOSS subscription prices listed for other offerings are not Workbench prices.