Ortelius vs ReARM

Ortelius connects software inventory to deployment information so teams can trace packages and versions to the endpoints where they run. It accepts SPDX and CycloneDX SBOMs and can create an SBOM with Syft when one is missing. It checks inventory against OSV.dev for newly disclosed vulnerabilities every ten minutes, tracing affected packages through artifacts and deployments to endpoints. Its post-deployment security dashboard brings together project security signals, versioned SBOMs, live deployments and vulnerability detection, and correlates OpenSSF Scorecard results with deployed packages and versions. Ortelius describes the dashboard as continuously aligned with NIST 800-218 SSDF. The product is available as SaaS or on-premise/self-hosted software, with REST and GraphQL APIs protected by JWT middleware. A GitHub App supports installation connections and repository onboarding, but onboarding does not attach an SBOM. Ortelius OS Free costs nothing, with up to 5 components; DeployHub Enterprise costs $40 a month, billed $40 / component / month.

ReARM is a release governance platform for organizing software composition, security findings, approvals, and evidence around what ships. It versions SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and search across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license metadata to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamp, and an evidence snapshot in an immutable audit trail. It connects with tools including GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, and Dependency-Track. ReARM Community Edition is self-hosted under AGPL 3.0 and can store and version BOMs without Dependency-Track; vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. A free plan is available; paid plans start at $195/mo, and a 60-day trial is listed.