17.6
Sigstore is a free, open source project focused on software supply chain security.
Free planOpen sourceWebAPILinux
Alternatives to DevGuard
DevGuard gives development and security teams an open-source way to harden software supply chains. It monitors deployed software for newly disclosed vulnerabilities, can create issues for affected CVEs, and prioritizes risk with scoring and exploit-probability analysis. VEX sharing helps assess false positives. Its scanner CLI covers software composition analysis, static application security testing, and signing attestations. DevGuard also accepts SBOM, VEX, and SARIF…
27.5
GUAC connects software metadata, including software bills of materials (SBOMs), to make supply-chain relationships queryable across a portfolio.
Free planOpen sourceWebAPILinux
37.4
OX Security is an enterprise application security platform spanning code through runtime, with real-time protection in AI editors and IDEs.
Free planWebAPIExtension
- 4
ActiveState Platform
ActiveState Platform hosts custom runtimes assembled from source.
Free planWebAPILinuxmacOS7.2Free plan - 5
JFrog Artifactory
JFrog Artifactory manages binaries, packages, containers, releases, AI/ML models, and agent assets as a shared system of record.
WebAPILinuxSelf-hosted7.1From $50 a month - 6
Wisec
Wisec collects and preserves software build evidence to help teams prepare for Cyber Resilience Act requirements.
Free planWebAPILinuxmacOS7.1From €990 a year - 7
SafeDep Platform
SafeDep Platform helps teams control open-source dependency risks from installation through pull requests and inventory.
Free planWebAPILinuxmacOS6.9From $100 a month - 8
StepSecurity
StepSecurity is a software supply chain security platform spanning developer machines, code repositories, and CI/CD pipelines.
Free planWebAPILinuxmacOS6.9From $8 a month - 9
Kusari
Kusari is a software supply chain security platform that builds an updated knowledge graph of components across repositories, images, and pipelines.
Free planWebAPI6.6From $50 a month - 10
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 11
Chainloop
Chainloop centralizes software delivery artifacts and evidence to support security, compliance, and visibility.
Free planWebAPILinuxmacOS6.3Free plan - 12
Anchore Enterprise
WebAPILinuxSelf-hosted6.2 - 13
CRACI
CRACI provides managed CI runners that capture software dependencies during builds and monitor them for vulnerabilities.
Free planWeb6.1Free plan - 14
Determinate Systems
Determinate Systems is a Nix platform that supports installation, collaboration, and deployment across developer laptops, CI, cloud infrastructure, and edge devices.
WebLinuxmacOSWindows6.0 - 15
Legit Security Secret Scanning
Legit Security Secret Scanning is a paid security platform available as SaaS, private cloud, on-premise, self-hosted, web, and API deployments.
WebAPISelf-hosted5.9 - 16
Lineaje SCA360
Lineaje SCA360 is a web-based cloud product for analyzing software supply chain security risks across development stages.
Web5.9$1 usage-based - 17
Safeguard DAST
Safeguard DAST is web-based security software with authenticated scanning, API testing, and CI/CD integration.
WebSelf-hosted5.8 - 18
Kosli
Kosli is a change-recording and compliance-monitoring platform for tracking and querying changes to software or business processes.
WebAPILinuxmacOS5.7 - 19
CypherEra
CypherEra is a web platform that combines cloud, identity, code, and AI security signals to identify risks and support continuous compliance.
Web5.3 - 20
NetRise Platform
NetRise Platform is an automated, cloud-based service for inventorying software and identifying supply-chain risks in compiled code.
Web5.3 - 21
ReversingLabs Spectra Assure
WebLinuxWindows5.0 - 22
Strig
Strig monitors firmware builds and records their inputs, compiler and linker events, and outputs.
Linux5.0 - 234.8