OTNOS SBOM 360 vs sbomify

OTNOS SBOM 360 helps operational technology manufacturers analyze, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and can produce CycloneDX VEX, OpenVEX and SBOMs containing embedded VEX. A read-only GitHub app links repositories to products and refreshes SBOMs after default-branch pushes and nightly checks. OTNOS mirrors more than 400,000 vulnerability advisories, syncs them daily and queries locally without sending component names outside the tenant. Findings include severity, EPSS, installed and fixed versions, CISA KEV status and EUVD identifiers. Users can record whether a finding is affected, not affected, fixed or under investigation, with supporting rationale and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for Article 14 reports and supports configurable alerts for new advisories, fixes, KEV listings and rising EPSS scores. Application and database data run in Germany; files and backups remain in EU regions. The Free plan costs $0/forever; Professional and Enterprise pricing is custom.

sbomify is a security artifact hub for generating, managing, analyzing and sharing software bills of materials (SBOMs) and compliance documents. It supports CycloneDX and SPDX, with generation workflows for 17 ecosystems, container images, directory scans and Yocto/OpenEmbedded builds. For CI/CD, its Action supports GitHub, while documented Docker workflows cover GitLab, Bitbucket and other systems. Vulnerability analysis integrations include Google OSV and OWASP Dependency-Track. Trust Centers let teams share security materials through a custom domain, with public or private access. Supported materials include SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports and compliance attestations. Trust Center content is also available programmatically through the Transparency Exchange API. The open-source platform can be self-hosted or used as a hosted service. The free Community plan limits accounts to one product, five components, public documents and one user. Business costs $159/mo (annual); Enterprise pricing is by custom quote.