OTNOS SBOM 360 vs ReARM

OTNOS SBOM 360 helps operational technology manufacturers analyze, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and can produce CycloneDX VEX, OpenVEX and SBOMs containing embedded VEX. A read-only GitHub app links repositories to products and refreshes SBOMs after default-branch pushes and nightly checks. OTNOS mirrors more than 400,000 vulnerability advisories, syncs them daily and queries locally without sending component names outside the tenant. Findings include severity, EPSS, installed and fixed versions, CISA KEV status and EUVD identifiers. Users can record whether a finding is affected, not affected, fixed or under investigation, with supporting rationale and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for Article 14 reports and supports configurable alerts for new advisories, fixes, KEV listings and rising EPSS scores. Application and database data run in Germany; files and backups remain in EU regions. The Free plan costs $0/forever; Professional and Enterprise pricing is custom.

ReARM is a release governance platform for organizing software composition, security findings, approvals, and evidence around what ships. It versions SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and search across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license metadata to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamp, and an evidence snapshot in an immutable audit trail. It connects with tools including GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, and Dependency-Track. ReARM Community Edition is self-hosted under AGPL 3.0 and can store and version BOMs without Dependency-Track; vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. A free plan is available; paid plans start at $195/mo, and a 60-day trial is listed.