SBOM Analysis: 11 Tools compared

CRACI is a software supply chain compliance platform from CRACI Corporation Oy, a Finnish company founded in 2025. It runs as a GitHub Actions runner, so builds stay in GitHub, and generates a software bill of materials from the build itself in CycloneDX or SPDX. Alongside the SBOM it tracks vulnerabilities across dependencies, lets teams assign and follow remediation, and produces the reporting the EU Cyber Resilience Act calls for, including vulnerability disclosure to ENISA. The workspace is organised around builds, security, inventory and compliance, and the vendor says other CI systems are on its roadmap. CRACI is delivered as a service and states ISO/IEC 27001 certification, with EU data residency, SAML and single sign-on on enterprise plans. The company raised 1.4 million euro in pre-seed funding in May 2026 in a round led by Lifeline Ventures, with First Fellow Partners and Wave Ventures.

NetRise analyses compiled code rather than source, building an SBOM from the binary so that a supplied manifest can be checked against the software that actually executes. The platform covers firmware and software components, with NetRise Provenance assessing open-source component and repository health, ZeroLens identifying weaknesses in compiled software, and Trace applying semantic search to code provenance and supply chain origin. Reachability analysis identifies which vulnerable code runs at startup so remediation can be prioritised. NetRise publishes a financial services solution brief covering the software supply chain of banking and trading applications, mapped to PCI DSS 4.0, NYDFS, the SEC cybersecurity rules and FFIEC. The company was founded in 2020 and is based in Austin, Texas.

PCA Cervus is a device-centric vulnerability monitoring and threat intelligence platform for embedded and connected products, made by PCA Cyber Security, the Munich- and Budapest-based embedded cybersecurity firm. PCA describes the workflow in six steps: upload an SBOM, Cervus validates the software components, new vulnerabilities are detected, affected products are identified, risk is prioritised and engineering is notified. It validates supplier SBOMs or generates them, models each device from its components, and correlates vulnerability and threat intelligence with those components, so the picture is built around the product rather than around individual CVEs. Monitoring continues after a product is released or certified, and PCA supports remediation through to patch validation. Compliance reporting covers the Cyber Resilience Act, PCI PTS, PCI DSS, UNECE R155, ISO/SAE 21434, IEC 62443-4-2 and RED / EN 18031. Cervus imports existing SBOMs, integrates with ticketing systems and exports data, and PCA says its AI-assisted analysis uses self-hosted models so product information stays under the customer's control. It is aimed at manufacturers, importers and operators of embedded products in payment, automotive, industrial, energy, medical and consumer IoT markets. PCA says the platform was developed with its offensive security researchers. Pricing and deployment options are not published.

Trivy is an open-source, comprehensive vulnerability scanner developed by Aqua Security that covers container images, file systems, Git repositories, Kubernetes clusters, and infrastructure-as-code configurations. Trivy stands out for its simplicity, speed, and breadth of scanning targets, requiring zero configuration to get started. It has become a widely adopted open-source scanner for container images in CI/CD pipelines and is widely adopted in Kubernetes-native environments for runtime vulnerability assessment.

Vulert is a software composition analysis service that monitors an application open-source dependencies for known vulnerabilities without access to source code. Projects are added by uploading a manifest or lockfile, for example package-lock.json, yarn.lock, pom.xml, requirements.txt, go.sum, Cargo.lock, composer.lock or Gemfile.lock, or an SBOM in SPDX or CycloneDX format, which Vulert checks against its own vulnerability database. Alerts are delivered through the dashboard and email, with Jira, CI/CD, Slack or Discord and SIEM integrations listed among the platform features, and separately priced modules for Docker image scanning, open-source licence compliance and SBOM export. It is a hosted SaaS product requiring no agent, installation or repository connection, operated by Vulert LTD, a company registered in England.