DevGuard

Overview

DevGuard connects repositories, CI pipelines and issue trackers, and can ingest SBOM, VEX and SARIF data from compatible scanners and tools. That makes it a practical coordination layer for teams that already generate security data, rather than a reason to discard their existing tools. The project is distributed under AGPL-3.0-or-later.

The platform monitors deployed software for newly disclosed vulnerabilities and can automatically create issues when a CVE affects it. Risk scoring and exploit-probability analysis help teams prioritize response, while sharing VEX assessments can help distinguish applicable risks from false positives. This combination is most useful where teams need to move from identifying exposure to assigning and tracking remediation.

Key features

Dependency and release security

The devguard-scanner CLI supports software composition analysis, static application security testing and signing attestations. DevGuard also supports SBOM management, build provenance, artifact signing, provenance attestations and release policy gates. Together, these capabilities address both what goes into software and how releases are documented and controlled.

Dependency firewall

The firewall checks npm, Go, PyPI and container image requests against a malicious-package database and blocks known-bad releases. That is a useful preventive control for teams working with those ecosystems, though its stated coverage does not extend to every package ecosystem.

Standards and compliance

Support for SBOM, VEX and SARIF inputs gives teams a standards-based way to bring scanner results into the platform. DevGuard also says it helps meet software development requirements associated with ISO/IEC 27001 and PCI-DSS; teams should view that as support for compliance work, not a substitute for their broader compliance program.

Pricing

The 14-day trial gives prospective buyers a limited window to assess the paid offering. The free tier is generous in features but not a general-purpose free plan: private commercial projects do not meet its stated public-project condition. Business adds managed operations and support, but its annual contract and yearly payment are a substantial step up from self-hosting.

Platforms

DevGuard supports API, Linux, macOS, self-hosted, web and Windows. Self-hosting is central to the free Open Source plan, while Business SaaS provides fully managed hosting in Germany.

Who it's for

Development and DevOps teams that want vulnerability monitoring, dependency checks and supply-chain controls in one workflow should put DevGuard on their shortlist. It is especially relevant to teams already producing SBOM, VEX or SARIF data and to eligible public open-source projects seeking a self-hosted option. A private commercial team wanting a no-cost hosted service should look elsewhere; Business is better suited to organizations that can justify a yearly commitment for hosting and support.

Pros and cons

• Broad supply-chain coverage: analysis, provenance, signing and release gates sit alongside vulnerability monitoring, reducing the need to treat these as disconnected workflows.
• Useful risk triage: exploit-probability analysis and VEX sharing help teams prioritize findings and address false positives.
• Meaningful free option for eligible projects: the Open Source plan includes all features at no cost, but requires public projects with an OSI-approved license and self-hosting.
• Business has a firm commitment: 10 users and monthly support hours are included, but the €449.10 monthly rate is tied to a one-year contract paid yearly.
• Firewall coverage is bounded: checks cover npm, Go, PyPI and container image requests, not every ecosystem.

Alternatives

Compare software supply-chain security software if you want to consider the category beyond DevGuard.

• Chainloop is worth considering for teams that prefer a self-hosted community edition at no cost; that edition has no UI or curated policy library.
• SafeDep Platform may suit teams that want free, open-source tools such as Vet, PMG, xBom and Gryph usable without a SafeDep account.
• ActiveState Platform offers a free organization plan for public projects, so it is another option for teams whose work is public.
• Kosli is an alternative with custom annual contracts based on recorded data and retention, with volume discounts and usage costs capped during the contract.
• OX Security may fit buyers seeking a quoted OX Code package spanning SAST, SCA, secrets and PII, SBOM, IaC, CI/CD, container scanning, IDE and CLI.
• Sigstore is a free option for developers and software providers considering a no-cost alternative.
• Kusari is another freemium option and may appeal to teams interested in its GUAC contributions.
• Determinate Systems is another freemium alternative.

Verdict

DevGuard is a strong fit for open-source maintainers and development-security teams that need vulnerability response alongside dependency and release controls. The breadth of its security workflow is the main reason to choose it; the public-project restriction on the free plan and annual Business commitment are the main reasons to look elsewhere.