Dependency-Track is a free OWASP platform for SBOM analysis, tracking components, vulnerabilities, and policy across your software supply chain at scale.
Category
Security
Pricing
Free/Open Source, from Free
Verified
Not yet
Last updated
July 18, 2026
Founded
2013
Free PlanWeb AppAPIOpen SourceSelf-Hosted
Overview
Dependency-Track is a free, open-source OWASP Flagship Project for software supply chain security, originating in 2013 and licensed under Apache 2.0.
It centers on the Software Bill of Materials (SBOM) as its unit of truth, ingesting CycloneDX SBOMs to continuously track components across every version of every project in an organization's portfolio.
Key Features
The platform continuously cross-references components against multiple vulnerability sources, prioritizes remediation using EPSS exploitability scores, and produces/consumes CycloneDX VEX and VDR documents.
Its redesigned v5 engine runs stateless instances coordinating through PostgreSQL alone, enabling active/active high-availability deployments that have been reported handling 250,000+ SBOMs and tens of millions of components in production.
Pricing
Dependency-Track is completely free and self-hosted, with no official commercial SaaS tier or licensing cost from the OWASP Foundation.
Organizations needing managed hosting or commercial support typically work with third-party vendors in the OWASP ecosystem rather than a single official vendor.
Key Features
SBOM Ingestion (CycloneDX) — Continuous component tracking across every version of every project.
Continuous Vulnerability Monitoring — Retroactive alerts the moment a new CVE affects a tracked component.
EPSS-Based Prioritization — Focus remediation effort on realistically exploitable risk.
VEX/VDR Support — Communicate real-world exploitability of component vulnerabilities.
Policy Engine — Enforce license and component policies across the portfolio.
High-Availability v5 Architecture — Stateless, active/active scaling coordinated through PostgreSQL.
REST API & CI/CD Integration — Automate SBOM ingestion as a pipeline stage.
Multi-Project Portfolio View — Track components across every version of every project in one place.
Pros & Cons
Pros
Completely free and open source under the permissive Apache 2.0 license
Purpose-built for continuous, SBOM-based monitoring rather than one-off scans
Backed by OWASP's vendor-neutral, nonprofit governance
Proven to scale to enterprise-size portfolios (250,000+ SBOMs in production reports)
Cons
Requires self-hosting and infrastructure management, with no official managed SaaS
Relies on quality, complete SBOMs from upstream build tooling to be effective
No official commercial support channel from OWASP itself
Steeper setup and learning curve than turnkey commercial SCA products
Pricing
Open Source Free N/A
Frequently Asked Questions
Is Dependency-Track free?
Yes, it is free and open source under the Apache 2.0 license.
What is an SBOM?
A Software Bill of Materials, a structured list of all components in a software project.
Who maintains Dependency-Track?
The OWASP Foundation and its open-source contributor community.
What SBOM format does Dependency-Track use?
CycloneDX, an OWASP-originated, internationally standardized SBOM format.
Can Dependency-Track integrate with CI/CD?
Yes, via its REST API for automated SBOM ingestion.
How is Dependency-Track different from DefectDojo?
Dependency-Track focuses specifically on SBOM-based component and vulnerability tracking, while DefectDojo aggregates findings across many types of security tools.