SBOM Analysis: 8 Tools compared

Tools and providers that build, validate or act on a software bill of materials. They differ most in what they start from: some read source code, manifests or an existing SBOM, while others reconstruct the component inventory from a…

8 tools|Updated August 2026

Quick comparison

All sbom analysis tools side by side, alphabetical.

ToolDeploymentPricing modelOpen sourceStandards / certs
Black DuckCloud + Self-hostedEnterprise license (project-based)
Finite StateCloudNot publicly disclosed
ONEKEYCloud + Self-hostedPlatform subscription + advisoryEU Cyber Resilience ActIEC 62443ETSI EN 303 645
PCA Cyber SecurityProject-based engagements
TrivySelf-hostedOpen source with commercial Aqua PlatformYes
VicOneCloud + Self-hostedSubscription (custom)ISO/SAE 21434UNECE R155Automotive SPICE (ASPICE) Level 2
VulertCloudPer-tier subscription capped by number of applications and users, billed monthly or annually, with extra applications charged monthly. Add-on modules are priced per application per month, including licence compliance, SBOM, container and Docker SBOM export.
VxLabsCloudSubscription for the ThreatZ platform; time and materials, fixed price or retainer for engineering services

Black Duck

Application Security
Best fit for

Enterprises needing the deepest open-source detection including undeclared components, M&A due diligence, and regulatory compliance for software supply chain

Black Duck (a Synopsys product) is an enterprise-grade software composition analysis platform that provides deep visibility into open-source risks, license compliance, and code origin analysis. Black Duck's multi-factor open-source detection uses package managers, file-level analysis, and code snippet matching to identify open-source components even when they are not declared in manifests, making it the most thorough SCA tool for auditing software acquisitions, M&A due diligence, and regulatory compliance. Black Duck is part of Synopsys's broader application security portfolio alongside Coverity (SAST) and Polaris.

Pricing

Custom enterprise pricing

Enterprise license (project-based)

Deployment

CloudSelf-Hosted

Finite State

Product Threat Intelligence Providers
Best fit for

Manufacturers of connected devices across IoT, automotive, medical, and industrial sectors needing firmware-level vulnerability and exploit intelligence tied to compliance evidence.

Finite State positions itself as the "Product Security OS for Connected Devices," analyzing firmware, binaries, and source code to generate SBOMs, identify vulnerabilities, and produce compliance evidence, embedded directly into release workflows. Its threat intelligence capability centers on exploitability-based prioritization and execution-aware reachability analysis, aimed at cutting through vulnerability noise to surface findings that are actually reachable and exploitable. It covers IoT and embedded systems, automotive and connected vehicles, medical devices, industrial control systems, and energy and utilities infrastructure, and supports EU Cyber Resilience Act, FDA, and NIST compliance frameworks.

Engagement

Not publicly disclosed

ONEKEY

Cyber Resilience Act Compliance
Best fit for

Device manufacturers wanting automated SBOM, vulnerability management, and CRA evidence generation across the product lifecycle

ONEKEY operates the ONEKEY Product Cybersecurity & Compliance Platform, which performs automated firmware analysis, SBOM generation, vulnerability detection, and zero-day discovery. Its Compliance Wizard maps product evidence against the CRA and other frameworks, and its CRA Fast Start program structures readiness assessment, SBOM creation, vulnerability management, and continuous monitoring. ONEKEY (formerly IoT Inspector) is part of PwC Germany's investment portfolio.

Founded

2020

Engagement

Platform subscription + advisory

Standards & accreditations

EU Cyber Resilience ActIEC 62443ETSI EN 303 645REDUNECE R155

PCA Cyber Security

PCI PTS Compliance Testing Companies
Best fit for

Payment-device makers and operators wanting offensive, real-world security testing of terminals beyond baseline PCI PTS certification

PCA Cyber Security is a Munich-based penetration-testing and security-research firm with a dedicated payment-device practice. It performs real-world security testing of payment terminals, PIN pads, unattended and self-service terminals, and fuel-pump and EV-charging payment systems, testing beyond PCI PTS certification to find vulnerabilities even in approved devices. PCA became a PCI SSC Associate Participating Organisation in 2026 and also runs a strong automotive and embedded security practice. PCA also offers software composition analysis and SBOM validation, reverse-engineering device firmware rather than relying on vendor documentation or an existing SBOM. The vendor describes reconstructing a verified component inventory from the firmware binary, mapping dependencies against runtime behaviour, surfacing undocumented components and mapping findings to CVEs, delivered as an extended bill of materials (xBOM). The service targets payment and financial devices including PTS terminals, smart POS, mPOS and ATMs, alongside automotive ECUs, kiosks, fuel pumps and EV charging interfaces.

Founded

2019

Engagement

Project-based engagements

Trivy

Application Security
Best fit for

DevOps and platform engineering teams that need a fast, open-source vulnerability scanner for containers and Kubernetes environments with zero configuration overhead

Trivy is an open-source, comprehensive vulnerability scanner developed by Aqua Security that covers container images, file systems, Git repositories, Kubernetes clusters, and infrastructure-as-code configurations. Trivy stands out for its simplicity, speed, and breadth of scanning targets, requiring zero configuration to get started. It has become a widely adopted open-source scanner for container images in CI/CD pipelines and is widely adopted in Kubernetes-native environments for runtime vulnerability assessment.

Pricing

Free (open source) / Aqua Platform for enterprise features

Open source with commercial Aqua Platform

Deployment

Self-HostedOpen Source

VicOne

Automotive Cybersecurity
Best fit for

OEMs and suppliers wanting a broad, lifecycle automotive security portfolio backed by an established cybersecurity parent

VicOne is a wholly-owned subsidiary of Trend Micro dedicated exclusively to automotive cybersecurity for connected and electric vehicles. It leverages Trend Micro's 30-plus years of security expertise and the Zero Day Initiative's vulnerability research network. The same program behind Pwn2Own Automotive. To give OEMs and suppliers lifecycle protection from development and production through in-vehicle operation. Its portfolio covers an in-vehicle IDPS, a managed VSOC, threat intelligence, SBOM and vulnerability management, and penetration testing services.

Founded

2022

Engagement

Subscription (custom)

Standards & accreditations

ISO/SAE 21434UNECE R155Automotive SPICE (ASPICE) Level 2TISAX Assessment Level 3

Vulert

Application Security
Best fit for

Small and mid-sized teams that want continuous open-source dependency and licence monitoring without granting a scanner access to their repositories.

Vulert is a software composition analysis service that monitors an application open-source dependencies for known vulnerabilities without access to source code. Projects are added by uploading a manifest or lockfile, for example package-lock.json, yarn.lock, pom.xml, requirements.txt, go.sum, Cargo.lock, composer.lock or Gemfile.lock, or an SBOM in SPDX or CycloneDX format, which Vulert checks against its own vulnerability database. Alerts are delivered through the dashboard and email, with Jira, CI/CD, Slack or Discord and SIEM integrations listed among the platform features, and separately priced modules for Docker image scanning, open-source licence compliance and SBOM export. It is a hosted SaaS product requiring no agent, installation or repository connection, operated by Vulert LTD, a company registered in England.

Pricing

Trial $0 (1 user, up to 50 apps); Starter $20/month; Pro $45/month; Growth $125/month; Enterprises from $500/month. Annual billing lists $18, $39 and $110 for the three paid tiers. 30-day free trial stated.

Per-tier subscription capped by number of applications and users, billed monthly or annually, with extra applications charged monthly. Add-on modules are priced per application per month, including licence compliance, SBOM, container and Docker SBOM export.

Deployment

Cloud

VxLabs

Automotive Cybersecurity
Best fit for

OEM and Tier 1 teams wanting an integrated TARA, SBOM and compliance evidence workspace, or project-based automotive security engineering.

VxLabs is an automotive cybersecurity and embedded software company founded in January 2022, registered in Regensburg, Germany (HRB 19099) with a US entity in Delaware. Its platform, ThreatZ, is an AWS-hosted SaaS launched in October 2025 that links system modelling, TARA, SBOM, vulnerability management, incident handling and compliance evidence in a single knowledge graph for ISO/SAE 21434 and UNECE R155. The company also sells engineering services covering AUTOSAR Classic and Adaptive ECU development, penetration testing, CSMS consulting and R155 type approval support. Uraeus was the earlier platform brand and uraeus.io now redirects to vxlabs.ai.

Founded

2022

Engagement

Subscription for the ThreatZ platform; time and materials, fixed price or retainer for engineering services

Related guides

Other categories you might be evaluating alongside sbom analysis.

About this listing

SBOM Analysis tools, listed alphabetically and compared on public information. How we work →

Frequently Asked Questions

A software bill of materials lists the components inside a piece of software: libraries, modules and third-party code, with versions. SBOM analysis is what you do with that list. At minimum it means matching components against known vulnerabilities so you know which CVEs apply to what you ship or run. Beyond that it covers licence obligations, dependency relationships, and whether the list is complete and accurate in the first place.

Generation produces the list, usually from source code, a package manifest or a build pipeline, so it reflects what the build was told to include. Validation checks that list against the thing that actually shipped, typically by analysing the compiled binary or device firmware. The two catch different problems: generation is cheap and continuous but inherits any gap in the build inputs, while validation can surface components nobody documented, including code added by a supplier further down the chain. Regulated buyers increasingly ask for both.

The Cyber Resilience Act requires manufacturers of products with digital elements to identify and document the components they contain, and to handle vulnerabilities in them. An SBOM is the practical way to meet that, which is why several tools in this category pair SBOM generation with CRA compliance reporting. Whether a generated SBOM alone satisfies an assessor, or whether you also need evidence that it matches the shipped firmware, depends on the product and the conformity route.

Yes. Binary and firmware analysis reconstructs the component inventory from the compiled artefact, which is how you assess a device from a supplier who will not share source, or verify a vendor-supplied SBOM. It is the standard approach for embedded and connected products, where the software you are assessing arrives as an image rather than a repository.