OWASP DevGuard

OWASP DevGuard is a vulnerability-management platform covering application code, dependencies, containers, infrastructure-as-code and deployed artifacts. It is aimed at developers, DevOps engineers and security teams that want one workflow with self-hosted control or managed hosting. The strongest case is broad, standards-oriented coverage; the main qualification is that the free tier is restricted to public, OSI-licensed projects.

Overview

DevGuard combines scanning, risk ranking and remediation tracking in a single backend and web interface. Its hybrid deployment model lets organizations run it on Kubernetes or Docker Compose, while the SaaS plan provides fully managed hosting in Germany. Source code is released under AGPL-3.0-or-later, and community support is provided through a Matrix space and monthly community call.

Key features

The security pipeline includes secret scanning, SAST, software-composition analysis, infrastructure-as-code scanning, container scanning and license compliance. That range is useful for teams trying to keep findings from code and infrastructure in one queue, although operating a broad pipeline still requires appropriate process and ownership.

Risk scoring combines CVSS-BE, EPSS and component depth. In practice, those signals help distinguish urgent, exploitable or deeply embedded issues from lower-impact alerts. Remediation tracking then connects prioritized findings to work that needs an owner.

Bidirectional synchronization with GitHub Issues, GitLab Issues and Jira, including slash-command triage, fits teams whose developers already work in those systems. Existing scanner investments can be retained: DevGuard imports CycloneDX SBOM and SARIF data from Trivy, Grype, Semgrep and other standards-compliant tools.

CycloneDX SBOM support, VEX workflows and live SBOM and VEX endpoints provide a way to maintain component inventories and communicate vulnerability status. Its dependency proxy covers npm, Go and PyPI and blocks packages identified in the OSSF malicious packages database, giving teams an additional control before dependencies enter a project.

Security and compliance features include in-toto attestations, SLSA provenance, cosign signatures and automated evidence for ISO 27001, the Cyber Resilience Act, BSI IT-Grundschutz and SLSA. These capabilities are most relevant to organizations with software-supply-chain or audit obligations.

Pricing

Open Source

The Open Source plan costs free and includes all features, community support and self-hosting. It is free for public projects with an OSI-approved license. That is a comprehensive option for qualifying open-source maintainers, but it does not serve private projects under the stated terms.

SaaS

SaaS starts at €449.10 a month, billed on a one-year contract and paid yearly. Ten user seats are included, along with fully managed hosting in Germany, an initial one-hour setup workshop and 8×5 email support. This suits organizations that want DevGuard without running Kubernetes or Docker Compose, but the annual commitment and relatively high starting spend make it a deliberate choice for teams with sustained usage.

Enterprise

Enterprise uses custom pricing with an annual subscription and a one-time initial setup. It is self-hosted and includes 20 to 160 support hours per year plus contractual response times of 16, 8 or 4 hours. This is the route for organizations that need formal support commitments and their own deployment, rather than a published self-service price.

A 14-day trial is available. The published plans do not describe additional seat or scan quotas beyond the SaaS plan's ten included seats.

Platforms

DevGuard offers an API and web interface, with deployment on self-hosted infrastructure or managed hosting. The standalone scanner runs on Linux, macOS and Windows. That combination works for mixed developer environments and teams that require control over where the service operates.

Who it's for

Developers, DevOps engineers and security teams are the stated audience, and the project positions specialized security knowledge as unnecessary. DevGuard is a strong fit when one organization needs code, dependency, container and infrastructure findings tied to existing issue trackers and compliance evidence. It is less suitable for a private project seeking a no-cost tier, or for a small team that cannot justify an annual SaaS contract.

Pros and cons

• Pro: Broad scanning spans secrets, code, dependencies, IaC, containers and licenses, reducing the need to manage those categories in isolation.
• Pro: CVSS-BE, EPSS and component-depth signals give remediation queues more context than a simple severity list.
• Pro: SBOM, VEX, SARIF and CycloneDX interoperability supports standards-based workflows and imports from established scanners.
• Pro: Self-hosting, supply-chain attestations and compliance evidence suit organizations with control or audit requirements.
• Con: The free Open Source plan is limited to public projects with OSI-approved licenses.
• Con: SaaS begins at 449.10 EUR monthly on a yearly contract, which may be excessive for small or short-term projects.
• Con: Enterprise pricing is custom and adds a one-time setup, so budgeting requires a sales process.

Alternatives

Browse vulnerability management software for a wider category comparison. ManageEngine Vulnerability Manager Plus is worth considering if its free and paid editions better match an on-premises vulnerability-management budget. Intruder suits readers wanting a free tier with five infrastructure targets and weekly external scans, though its free plan excludes web apps. Nanitor is an option when asset-count pricing, including a 10-asset free plan and a 6.00 USD monthly Standard plan, is the priority. Qualys External Attack Surface Management fits a 30-day external attack-surface evaluation rather than a permanently free tier. Zscaler Private Access is a paid private-access product. OWASP DefectDojo is another open-source vulnerability platform with a free Community Edition and paid usage option. Ivanti Neurons for Zero Trust Access is a paid, named-user zero-trust access service. WPSec targets website scanning, with a free tier and a 19.00 EUR monthly Premium plan per website.

Verdict

Choose OWASP DevGuard if you need application, dependency, container and infrastructure security connected to prioritized remediation, standards-based exchange and optional self-hosting. Its main reason to look elsewhere is commercial fit: private users must move to an annual SaaS commitment or custom enterprise terms, while the free plan is reserved for qualifying public projects.