Ortelius

Overview

Ortelius is an SBOM and deployment-security platform for teams that need to connect software inventory with the systems running it. Its strongest fit is organizations tracking open-source components across live deployments; its value is less clear for teams seeking only a place to store SBOMs.

It links packages and versions to artifacts, deployments and endpoints, then checks that deployed inventory for newly disclosed vulnerabilities. That endpoint-level view can help teams determine where a finding matters, but repository onboarding alone does not provide an SBOM.

Key features

Ortelius consumes SPDX and CycloneDX SBOMs and can generate one with Syft when needed. Its GitHub App imports release and deployment metadata, but does not attach an SBOM, so teams must arrange that part of onboarding separately.

The platform queries OSV.dev every ten minutes and remaps vulnerability intelligence against deployed SBOMs on the same interval. Findings can be followed from an affected package and version through its artifact and deployment to the endpoint, which is more actionable for teams responsible for deployed systems than a package-only vulnerability list.

A post-deployment dashboard connects project security signals, versioned SBOMs, live deployments and vulnerability detection. Ortelius also correlates OpenSSF Scorecard results with deployed packages and versions, and uses a deployment-aware software digital twin to keep component visibility tied to where software runs. The dashboard describes continuous alignment with NIST 800-218 SSDF; that is an alignment focus, not a substitute for a team's own compliance work.

Teams can use the CLI in CI/CD pipelines to capture supply-chain data at build and deployment stages. The REST and GraphQL APIs use JWT middleware. Ortelius is incubating at the Continuous Delivery Foundation, part of the Linux Foundation, which legally owns the project assets; community support is available through Discord and GitHub issues.

Pricing

Ortelius OS Free: free (billed Free). It supports up to 5 components, unlimited users and unlimited endpoint tracking, with community support. This is a practical starting point for small deployments or evaluation, but the five-component ceiling limits its usefulness as inventory grows.

DeployHub Enterprise: $40 a month (billed $40 / component / month). It offers pay-as-you-grow component coverage, group-level access controls, SaaS or self-hosted deployment, and commercial support. The per-component monthly charge makes expanding coverage a recurring cost; it suits teams that need broader coverage or enterprise access controls and support. Both plans support SBOM standards and deployment models, vulnerability and license analysis, SBOM exchange and release monitoring.

Platforms

Ortelius OS is available as SaaS or on-premise/self-hosted software, with API access. The hosted version at app.deployhub.com requires no infrastructure setup. Free access controls are user-level; DeployHub adds group-level controls and LDAP/Active Directory support.

Who it's for

Ortelius suits security and release teams that need to connect SBOMs to deployed endpoints and quickly identify which systems contain a newly vulnerable component. It is also a fit for teams that can incorporate CLI-based supply-chain capture into CI/CD or manage their own SBOM attachment. Teams without an SBOM workflow should account for that onboarding gap, while organizations with more than five components will need the per-component Enterprise plan for expanded coverage.

Pros and cons

• Pro: Vulnerability findings map through artifacts and deployments to endpoints, helping teams prioritize affected systems.
• Pro: Ten-minute OSV.dev checks and remapping keep deployed inventory connected to newly disclosed vulnerabilities.
• Pro: The free plan allows unlimited users and endpoint tracking, useful for small inventories with multiple stakeholders.
• Con: Free coverage stops at five components, so broader inventory entails a recurring per-component charge.
• Con: GitHub onboarding imports release and deployment metadata but does not attach an SBOM, leaving a separate setup task.
• Con: Community support is the free plan's support model; commercial technical support is part of DeployHub Enterprise.

Alternatives

For a broader comparison, see SBOM Management Software.

• Sonatype Nexus Repository is worth considering for teams looking for repository software with CI/CD integration and a free Community Edition; it also offers a paid Pro Edition.
• Interlynk may suit teams seeking a free SBOM option without per-seat fees or per-SBOM metering.
• sbomify is an alternative for teams whose free Community plan's one product, five components, unlimited SBOMs and compliance documents, public documents and single-user access fit their needs.
• CAST SBOM Manager is a free-download alternative for Linux and Windows users.
• Exodos Labs offers a free Community plan with unlimited inventories, one user and one API key, and a Team plan for those considering a paid tier.
• FOSSA may fit teams wanting a free plan with explicit project, developer, release-group and scan-depth limits.
• ReARM is an alternative for teams seeking self-hosted SBOM/XBOM storage and retrieval on a single-organization community plan.
• TRUSCA is a free, self-hosted option with no per-seat licensing.

Verdict

Choose Ortelius if your priority is tracing vulnerable SBOM components to the endpoints where they are deployed, and you can support the separate SBOM onboarding step. Its ten-minute vulnerability remapping and unlimited endpoint tracking on the free plan are compelling for a small inventory; look elsewhere if you need free coverage beyond five components or a workflow that attaches SBOMs during GitHub onboarding.