Steering platforms

Level 2 tools: they aggregate the portfolio’s SBOMs and re-evaluate them continuously. See Generate and steer.

Caveat. These profiles describe categories of solution and their structural properties, not a snapshot of the market. Any purchasing decision must rest on an evaluation run against your own artefacts, following the protocol in Selection criteria.

OWASP Dependency-Track


Site	dependencytrack.org
Steward	OWASP
Licence	Open
Deployment	Self-hostable — full data sovereignty
Input	Native CycloneDX ingestion, via API
Functions	Continuous portfolio re-evaluation, policies, VEX support, project and version management, full API, notifications
Sources	Aggregated public databases
Licences	Tracking of declared licences, with associated policies
Strengths	Zero software cost; designed for exactly the use the CRA imposes: aggregating SBOMs and replaying them over time; good API; self-hosting
Limits	Real operating cost; no reachability analysis; licence detection limited to declared metadata; austere interface
Verdict	The best entry point. Lets you demonstrate value and run in the processes before any investment, and remains sufficient for many organisations

Snyk


Site	snyk.io
Model	Service, usage-based pricing
Orientation	Developer experience
Strengths	Strong integration with IDEs, repositories and CI chains; enriched vulnerability database; automated fix suggestions; reachability analysis
Limits	Vendor-hosted data — to be assessed against sovereignty requirements; cost grows with project count; the licensing strand is shallower than the specialists’
Verdict	Relevant where the goal is to get development teams to adopt the topic

FOSSA


Site	fossa.com
Model	Service
Orientation	Licence compliance and intellectual property, with a security strand
Strengths	Attribution file generation; legal policy management; reports suited to investor and acquirer diligence; speaks Legal’s language
Limits	Shallower security strand than the specialists; hosting to be assessed
Verdict	Worth considering where the intellectual property strand drives the programme

Black Duck


Site	www.blackduck.com
Model	Enterprise, hosted or on-premises
Orientation	Enterprise software composition analysis
Strengths	File-hash analysis — detects copy-pasted code and undeclared components, which no manifest analysis sees; very deep licence coverage; strong presence in embedded and regulated sectors
Limits	High cost; large result volumes requiring review effort; heavy deployment
Verdict	Relevant for embedded, regulated sectors and organisations exposed to licence audits

Mend


Site	www.mend.io
Model	Service, enterprise
Strengths	Automated remediation, reachability-based prioritisation, broad coverage
Limits	Hosting to be assessed; functional overlap with the above
Verdict	A credible alternative in the enterprise segment

Sonatype Nexus Lifecycle


Site	www.sonatype.com
Model	Enterprise
Distinctive feature	Tight coupling with the artefact repository
Strengths	Applies policy at the repository gate: a non-compliant component never enters the organisation, moving the control upstream
Limits	Coherent mainly if the artefact repository is already from this vendor
Verdict	Worth considering if you want to block at source rather than in CI

JFrog Xray


Site	jfrog.com/xray
Model	Enterprise
Distinctive feature	Integrated with the same vendor’s artefact repository
Verdict	Relevant if and only if that repository is already in place; otherwise the coupling is a drawback

GUAC


Site	guac.sh
Nature	An open project that aggregates and graphs supply chain metadata — SBOMs, attestations, advisories
Use	Complex cross-cutting queries over the dependency and provenance graph
Verdict	Worth watching, for advanced uses; does not replace a steering platform today

What really separates these solutions

Beyond feature lists, four axes make a real difference:

Detection method. Manifests only, or file-hash analysis? That determines whether vendored code is visible.
Depth of the licensing strand. Declared metadata, or content analysis and attribution generation?
Reachability. Can the product tell you whether the vulnerable function is called? That is the main lever against noise.
Sovereignty and reversibility. Where is the data, and can you leave with your SBOMs and your history?

The fourth is the one forgotten at purchase and the most expensive on exit.