Dependency Firewall offer: 50% off the base fee. See pricing

SBOM Observerfor every software release

Every SBOM from your builds and suppliers, checked against new advisories and your policies, release by release.

Open the live demoBook a demo
  • Built in Sweden and hosted in the EU
  • Supply chain security since 2018

SBOM formats and sources

  • CycloneDX 1.3+
  • SPDX 2.2+
  • Syft
  • Trivy
  • cdxgen
  • Your SCA tool
  • Supplier SBOMs

See every component a vulnerability reaches

A new advisory is matched against every SBOM you have stored, and traced through the dependencies to each application and release that ships it.

Trends across releases

Policy violations and vulnerabilities by severity, with the trend across releases.

The dashboard in the live demo. No signup needed.

After an SBOM is uploaded

Try the free SBOM AnalyzerSBOM managementVulnerability impactSoftware inventory

Inside SBOM Observer

Impact graphCVE-2023-4863 in libwebp, traced through the dependencies that pull it in.
Container layersA Keycloak image with components and vulnerabilities per layer.

SBOMs from CI/CD and suppliers

  • From CI/CD

    The Observer CLI generates, checks and uploads an SBOM from every run in GitHub Actions, GitLab CI, Jenkins, Azure DevOps or CircleCI.

  • From suppliers

    Upload a supplier SBOM and it goes through the same policies as your own, VEX included.

  • Kept per release

    SBOM, VEX and SLSA provenance stay with the release they describe, version after version.

Included in Business and Enterprise

Formats
CycloneDX 1.3+ and SPDX 2.2+, in JSON, XML, YAML and tag-value.
Advisories
OSV, GitHub Advisories and NVD, with EPSS next to CVSS.
Policy engine
Open Policy Agent. A visual builder, or Rego and JavaScript.
Component graph
Components deduplicated across SBOMs, with direct and transitive paths.
Dashboards
Per application, with the trend across releases.
Container SBOMs
Base layer, system packages and application dependencies kept apart, each traced to its layer.
Component origin
SLSA provenance and the OpenSSF Scorecard of each component's source repository.
Deployment
SaaS in the EU. On-premises and air-gapped on Enterprise.

Questions

Does SBOM Observer monitor SBOMs after upload?
Yes. Every component in every stored SBOM is monitored against GitHub Advisories, OSV and NVD. When a new advisory is published, it shows up against the applications and releases that ship the affected component.
Which SBOM formats does SBOM Observer accept?
CycloneDX 1.3 and later, and SPDX 2.2 and later, in JSON, XML, YAML and tag-value. Any generator that produces these works, including Syft, Trivy and cdxgen.
Does SBOM Observer handle supplier SBOMs?
Yes. Upload a supplier SBOM and it goes through the same policies as your own. An SBOM that misses required fields, such as the supplier name, fails the NTIA minimum elements policy.
Can we use our current SCA tool with SBOM Observer?
Yes. Export CycloneDX or SPDX from it and upload the result. SBOM Observer adds monitoring, policy, VEX and release history on top of what the tool found.
Can we run SBOM Observer on-premises?
Yes. The Enterprise plan includes on-premises deployment, including air-gapped environments.
Can we try SBOM Observer before we buy?
Yes. The live demo and the free SBOM Analyzer need no signup. To see it with your own SBOMs, book a demo with one of our engineers.

Also in the Bytesafe platform

Start with one SBOM

Click through the live demo with example data, or bring your own SBOMs to a demo with an engineer.

Open the live demoBook a demo

Or analyze one SBOM for free, no signup. Sign up from €69 per user per month.