Ortelius vs SBOMApp
Ortelius
ortelius.ioSBOMApp
sbomapp.comSide by side
| Figure | Ortelius | SBOMApp |
|---|---|---|
| Price from | $40/mo | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · SBOM Management Software | 8.8 (#1) | 7.2 (#17) |
| Governance | The project incubates at the Continuous Delivery Foundation, part of the Linux Foundation, under open governance. | SBOM App Core provides role-based access control, encrypted access-controlled report links, and policy-as-code validation across builds. |
| Purpose | Ortelius maps SBOM packages and versions to artifacts, deployments, environments, and production endpoints. | SBOM App helps enterprises generate, analyze, govern, remediate, and securely share software bills of materials across the software development lifecycle. |
| SBOM formats | It consumes SPDX and CycloneDX SBOMs and can generate an SBOM with Syft when one does not exist. | It supports SBOM generation in SPDX 3.0 and CycloneDX 1.7 formats. |
| Support | Ortelius OS provides community technical support, while DeployHub Enterprise includes commercial technical support. | Pricing is customized to support and service requirements, with standard support, priority support, onboarding, and dedicated assistance listed as options. |
Plans
In their own words
Ortelius
Ortelius connects software inventory to deployment information so teams can trace packages and versions to the endpoints where they run. It accepts SPDX and CycloneDX SBOMs and can create an SBOM with Syft when one is missing. It checks inventory against OSV.dev for newly disclosed vulnerabilities every ten minutes, tracing affected packages through artifacts and deployments to endpoints. Its post-deployment security dashboard brings together project security signals, versioned SBOMs, live deployments and vulnerability detection, and correlates OpenSSF Scorecard results with deployed packages and versions. Ortelius describes the dashboard as continuously aligned with NIST 800-218 SSDF. The product is available as SaaS or on-premise/self-hosted software, with REST and GraphQL APIs protected by JWT middleware. A GitHub App supports installation connections and repository onboarding, but onboarding does not attach an SBOM. Ortelius OS Free costs nothing, with up to 5 components; DeployHub Enterprise costs $40 a month, billed $40 / component / month.