OWASP Dependency-Track
6.2#10 in sbom management softwareFree planFree planWebAPISelf-hosted
VisitOWASP Dependency-Track vs ReARM
What both publish
| Fact | OWASP Dependency-Track | ReARM |
|---|---|---|
| Founded | 2013 | 2019 |
| Integrations | Alerts can be routed to Slack, Teams, Mattermost, email, and webhooks, with filters based on event fields. | The documentation lists GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider integrations. |
OWASP Dependency-Track plans
- Dependency-TrackFree
ReARM plans
- ReARM CEFree
- ReARM Pro - Enterprise$75 a month
- ReARM Pro - Starter$195 a month
- ReARM Pro - Standard$1,350 a month
Pick OWASP Dependency-Track if…
It suits teams managing software component risk across projects, from a single team to large enterprise portfolios. Organizations must be able to self-host and meet the PostgreSQL requirement for version 5.
Pick ReARM if…
ReARM suits teams that need to track software bills of materials, release evidence, and approval decisions. Its self-hosted Community Edition is an option for organizations able to manage Dependency-Track when they need vulnerability scanning or policy findings.