OTNOS SBOM 360 vs OWASP Dependency-Track
OTNOS SBOM 360
otnos.com
OWASP Dependency-Track
dependencytrack.orgSide by side
| Figure | OTNOS SBOM 360 | OWASP Dependency-Track |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 3 | 1 |
| Spec score · SBOM Management Software | 7.4 (#15) | 7.7 (#11) |
| Integrations | Listed integrations and data sources include GitHub, OSV, GitHub Advisories, CISA KEV, FIRST EPSS, ENISA EUVD, endoflife.date, Microsoft Power Automate, webhooks, REST API and MCP for AI agents. | Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields. |
| Purpose | SBOM 360 ingests, analyzes, assesses, monitors and reports software products for OT manufacturers responding to the Cyber Resilience Act. | Dependency-Track inventories software components from SBOMs, identifies vulnerabilities, and helps enforce policy across the software supply chain. |
| SBOM formats | The platform consumes CycloneDX and SPDX SBOMs and produces CycloneDX VEX, OpenVEX and SBOMs with embedded VEX. | It consumes, analyzes, and produces CycloneDX SBOM, HBOM, VEX, and VDR documents. |
| Vulnerability intelligence | OTNOS mirrors more than 400,000 advisories across ecosystems, synced daily and queried locally without sending component names outside the tenant. | It matches components against the NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB. |
Plans
OTNOS SBOM 360
- FreeFree
- EnterprisePriced on request
- ProfessionalPriced on request
In their own words
OTNOS SBOM 360
OTNOS SBOM 360 helps operational technology manufacturers analyze, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and can produce CycloneDX VEX, OpenVEX and SBOMs containing embedded VEX. A read-only GitHub app links repositories to products and refreshes SBOMs after default-branch pushes and nightly checks. OTNOS mirrors more than 400,000 vulnerability advisories, syncs them daily and queries locally without sending component names outside the tenant. Findings include severity, EPSS, installed and fixed versions, CISA KEV status and EUVD identifiers. Users can record whether a finding is affected, not affected, fixed or under investigation, with supporting rationale and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for Article 14 reports and supports configurable alerts for new advisories, fixes, KEV listings and rising EPSS scores. Application and database data run in Germany; files and backups remain in EU regions. The Free plan costs $0/forever; Professional and Enterprise pricing is custom.
OWASP Dependency-Track
OWASP Dependency-Track is a free, self-hosted platform for managing software-component risk across a supply chain. It builds inventories from software bills of materials and identifies vulnerable components, supporting CycloneDX SBOM, HBOM, VEX, and VDR documents for ingestion, analysis, and production. Components can be matched against NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB, while integrated EPSS support helps prioritize mitigation. Integrity checks flag components when published hashes differ from those served by an upstream registry. A Common Expression Language policy engine evaluates component rules and can break a build when a policy fails. Alerts can be filtered by event fields and sent to Slack, Teams, Mattermost, email, or webhooks. API and web interfaces are available, with least-privilege portfolio access and single sign-on through OpenID Connect, Active Directory, and LDAP. Version 5.1 uses separate API and frontend container images, supports Kubernetes, and requires PostgreSQL.