SBOM Observervs. Dependency-Track

Both check SBOMs for vulnerabilities and policy violations. Dependency-Track is open source and you run it yourself. SBOM Observer is a managed service in the EU. They also differ in formats, release history and how you write policies.

Open the live demo Book a demo

Where they differ

From Dependency-Track's public documentation. If something is out of date, tell us.

SBOM ObserverDependency-Track

SPDX import: SBOM ObserverYes2.2 and later: JSON, YAML, RDF/XML and tag-value; Dependency-TrackNoCycloneDX is the only upload format
Uploaded documents kept per release: SBOM ObserverYesEvery SBOM, VEX and SLSA document stays with the release it describes; Dependency-TrackPartlyOne inventory per project version. A new upload to the same version replaces it
SLSA provenance: SBOM ObserverYesImported and shown on the component page; Dependency-TrackNo
OpenSSF Scorecard: SBOM ObserverYesFor each component's source repository; Dependency-TrackNo
Impact across applications: SBOM ObserverYesGraph from the vulnerable package to every application and release, with the dependency path; Dependency-TrackPartlyList of affected projects. Dependency graph per project
Container layers and base images: SBOM ObserverYesComponents and findings per layer; Dependency-TrackNo
Policies as code: SBOM ObserverYesRego (Open Policy Agent) or JavaScript, with the full data model; Dependency-TrackPartlyCEL expression conditions. Vulnerability policies can sync from YAML bundles
SBOM quality policies: SBOM ObserverYesTemplate for NTIA minimum elements; Dependency-TrackNo
Fail the CI/CD build: SBOM ObserverYesObserver CLI exits non-zero on a violation; Dependency-TrackPartlyThrough the REST API or community plugins
Managed service: SBOM ObserverYesHosted in the EU; Dependency-TrackNoThe project ships self-hosted software only
Single sign-on: SBOM ObserverPartlySAML, on the Enterprise plan only; Dependency-TrackYesOIDC and LDAP, included
Open source: SBOM ObserverNo; Dependency-TrackYesApache 2.0, OWASP project
Commercial support and SLA: SBOM ObserverYes; Dependency-TrackNoCommunity support

Where they match

CycloneDX import1.3 and later, JSON and XML. Dependency-Track: All versions up to 1.7, JSON and XML.
SBOM exportCycloneDX and SPDX. Dependency-Track: CycloneDX: BOM, BOM with vulnerabilities, VDR.
Vulnerability dataOSV, GitHub Advisories and NVD. Dependency-Track: NVD, GitHub Advisories and OSV, plus OSS Index, Snyk, Trivy and VulnDB analyzers.
Continuous monitoringNew advisories matched against every stored release. Dependency-Track: Scheduled re-analysis of the portfolio.
EPSSCovered by both.
Container OS packagesDependency-Track: Distribution-aware version matching.
VEX importCycloneDX VEX and OpenVEX. Dependency-Track: CycloneDX VEX.
VEX exportCycloneDX VEX. Dependency-Track: CycloneDX VEX and VDR.
Triage in the UIState, justification and response per finding. Dependency-Track: Analysis per finding, and vulnerability policies across projects.
Visual policy builderCan be converted to code later.
License policiesDependency-Track: License groups and SPDX expressions.
Self-hostedEnterprise plan, including air-gapped. Dependency-Track: Container images, PostgreSQL 14 or later, air-gapped guide.

How SBOM Observer works differently

Every document stays with its release

SBOM Observer keeps every SBOM, VEX and SLSA document you upload, attached to the release it describes. Components are deduplicated across all of them: a library used by ten applications is one record with ten links.

Use case: SBOM management

Dependency-Track: Dependency-Track keeps one component inventory per project version. A new upload to the same version reconciles the list. To keep a release as a record, you clone the project to a new version.

Component

openssl 3.0.7

pkg:deb/debian/openssl@3.0.7

Vulnerability: CVE-2023-0286
VEX: Not affected
License: Apache-2.0
Provenance: SLSA fetched

Payments API
4.2.1
Checkout
2.8.0
Mobile API
1.14.3

Used by three releases. Stored, enriched and reviewed once.

One view of what a vulnerability reaches

Open a vulnerability and SBOM Observer draws a graph from the vulnerable package to every application and release that ships it, with the dependency path in between.

Impact graph for CVE-2023-4863 in libwebp, traced through the dependencies that pull it in

Use case: Vulnerability impact

Dependency-Track: Dependency-Track lists the projects a vulnerability affects. The dependency graph is shown per project.

Policies you can write as code

Build a policy in the visual builder, or write it in Rego or JavaScript against the full data model. The Observer CLI evaluates it in CI/CD and exits non-zero on a violation. Templates cover NTIA minimum elements and copyleft licenses.

build job in CI

# Generate an SBOM for this build
observer fs -o sbom.cdx.json .
 
# Evaluate your policies. Exits non-zero on a violation
observer analyze sbom.cdx.json
 
# Upload for monitoring when the build passes
observer upload sbom.cdx.json

Failed

Library Vulnerabilities EPSS/VEX

spring-beans 5.3.17: CVE-2022-22965 with CVSS 9.8 and EPSS 0.98 is not tolerated for a library

Use case: Regulatory compliance

Dependency-Track: Dependency-Track policies combine conditions such as license, age, severity and EPSS. A CEL expression covers what the built-in conditions cannot. Pipelines read the result through the REST API.

Which one fits

Most teams can tell from how they want to run it and which formats they receive.

SBOM Observer fits when

You want a managed service hosted in the EU, with support and an SLA.
You receive SPDX as well as CycloneDX, for example from suppliers.
You need to see every application and release a vulnerability reaches, and through which dependency.
You want policies in Rego or JavaScript that fail the build, including SBOM quality checks.
You keep SBOM and VEX evidence per release for CRA, NIS2 or DORA.

Dependency-Track fits when

You want open source, and have people to run it: upgrades, PostgreSQL, backups and the vulnerability data mirrors.
Your SBOMs are all CycloneDX.
You use its integrations: notifications to Slack, Teams or Jira, findings sent to DefectDojo.

Dependency-Track 5 means a migration

Version 5 rebuilds the backend and changes how you deploy it. Teams on v4 migrate by hand before v4 reaches end of life in December 2026, which makes it a natural point to compare.

Version 5.0 shipped in June 2026 and 5.1 in August 2026.
PostgreSQL 14 or later is the only supported database. H2, MySQL and SQL Server support is gone.
It ships as container images only. The WAR file and the bundled image are discontinued.
Moving from v4 is a manual migration, from v4.14.2 or later.
Version 4 reaches end of life in December 2026.

Moving from Dependency-Track

Both speak CycloneDX, so your SBOMs and VEX decisions move over as files.

1
Export from Dependency-Track
Export each project as a CycloneDX SBOM, and its analysis decisions as CycloneDX VEX.
```
GET /api/v1/bom/cyclonedx/project/{uuid}GET /api/v1/vex/cyclonedx/project/{uuid}
```
2
Upload to SBOM Observer
Upload both files. SBOM Observer reads the analysis states from the VEX, so your triage decisions come with the components. New releases then come in from CI/CD with the Observer CLI.
```
observer upload sbom.cdx.json
```
3
Rebuild your policies
Recreate component policies in the visual builder or in Rego. Start from the templates for NTIA minimum elements and copyleft licenses.

Trust Repository may be all you need

If the job is to collect SBOMs and VEX from your suppliers, share your own with customers and run basic vulnerability and policy checks on them, Trust Repository covers it. It is a hosted service, so there is no server to run.

Add SBOM Observer when you need impact analysis across releases, your own policies in CI/CD and VEX review.

See Trust Repository

Suppliers

SBOM and VEX

Trust Repository

Collect, check, share

Customers

Download

Questions

Does Dependency-Track support SPDX?

No. As of version 5.1, CycloneDX is the only format Dependency-Track accepts for upload. SBOM Observer accepts CycloneDX and SPDX.

Can we move our data from Dependency-Track to SBOM Observer?

Yes. Export each project as a CycloneDX SBOM and its analysis decisions as CycloneDX VEX, then upload both to SBOM Observer. Policies are recreated in SBOM Observer.

Does SBOM Observer come with support?

Yes. Business includes support with an answer within 1 business day. Enterprise adds an SLA and a dedicated support channel.

Can SBOM Observer run on our own servers, like Dependency-Track?

Yes. The Enterprise plan includes on-premises deployment, including air-gapped environments.

What does SBOM Observer cost?

Business is for small teams. Enterprise is for 25 or more users, and adds SSO, audit logs, an SLA and on-premises deployment. See SBOM Observer pricing.

Bring a Dependency-Track export

Click through the live demo, or book a call with an engineer and bring an SBOM or a Dependency-Track export.