Compare / Dependency-Track

Stackurity vs OWASP Dependency-Track

Q: Can Stackurity import the SBOMs I already make?

Yes. Stackurity imports CycloneDX or SPDX JSON with stackurity sbom import or the API, matches the components against vulnerability advisories, the CISA KEV catalogue and end-of-life data, and can export any asset as CycloneDX 1.6.

Two open-source tools for knowing which components are vulnerable. Dependency-Track analyses the SBOMs you give it; Stackurity collects a live inventory from what you run and tracks each fix to the end.

In short. Dependency-Track and Stackurity are both open source under Apache-2.0, both find components with known vulnerabilities, and both use the CISA Known Exploited Vulnerabilities catalogue to rank them. They start from different places. Dependency-Track analyses the CycloneDX BOMs your pipelines upload and is strong on portfolio-wide tracking, licence and security policies, and VEX. Stackurity collects its own inventory from servers, deployed applications, repositories, images, Kubernetes and AWS (and also imports SBOMs), adds end-of-life dates, and tracks each fix until a fresh report from the server confirms it.

If your software is described by SBOMs from your builds and your suppliers, Dependency-Track is a mature choice. If you need to know what is running on your servers today and what to upgrade first, Stackurity fits better. They also work together.

What each one is

OWASP Dependency-Track

Dependency-Track is an OWASP project that describes itself as a component analysis platform built around the Bill of Materials^[1]^[2]. It tracks component usage across every version of every project in a portfolio, re-analyses that portfolio on a schedule, and surfaces vulnerabilities, policy violations and licence risk^[2]. It takes CycloneDX BOMs from any pipeline through its API, and adds policies written in CEL, VEX and VDR exchange, and dashboards over time^[2]^[5]. This page describes version 5, the current major version, up to version 5.2 of October 2026^[8]; version 4 is in maintenance on the 4.14 line and reaches end of life in December 2026^[1].

Stackurity

Stackurity is open-source vulnerability and end-of-life management. It keeps one live inventory of the software on your servers, deployed applications, repositories, container images, Kubernetes and AWS managed services. It matches that inventory against new advisories every hour and against the CISA KEV catalogue and end-of-life dates every day, and gives each team a short list of upgrades, most urgent first. After a fix it checks again and records whether the issue is really gone. The core is Apache-2.0; it runs self-hosted for free or as Stackurity Cloud.

Dependency-Track vs Stackurity, side by side

Scroll the table sideways to see every column.

	Dependency-Track	Stackurity
Inventory sources	CycloneDX BOMs uploaded from any pipeline or build tool with an API call; CycloneDX is the only upload format^[2]^[5]	Its own read-only agent on Linux servers (installed packages, runtimes installed by hand, the libraries deployed applications load), repositories and CI scans, container images, Kubernetes workloads, AWS managed services, and CycloneDX or SPDX SBOM import
Ecosystems	Any ecosystem a CycloneDX BOM describes, including services and the dependency graph^[2]. Newer-version checks against Cargo, Composer, RubyGems, GitHub Actions, Go, Hex, Maven, npm, NuGet, PyPI and CPAN repositories^[6]	Operating system packages assessed on Debian, Ubuntu, Alpine, Rocky Linux, AlmaLinux, Red Hat Enterprise Linux, SUSE Linux Enterprise, openSUSE Leap and Amazon Linux 2023 and 2. npm, Composer, PyPI, Go, RubyGems, NuGet and Dart; Maven, Gradle, Cargo, Hex and Swift through stack packs (C/C++ and CocoaPods are inventoried only)
Vulnerability sources	Mirrors NVD, GitHub Advisories and OSV; analyzers for Sonatype OSS Index, Snyk, Trivy and VulnDB; private vulnerabilities of your own^[2]. The Trivy analyzer needs a separately deployed Trivy server^[7]	OSV and vendor advisories, checked every hour, using each ecosystem’s own version rules so distribution backports are not reported as false alarms
End-of-life tracking	Detects outdated components by checking package repositories for newer versions, and policies can flag old components^[2]. End-of-life dates are not covered in the docs we checked	End-of-life dates for operating systems, runtimes, Kubernetes and AWS managed services, checked daily. A distribution’s own patched package is not flagged just because the upstream version ended
CISA KEV and exploitation priority	Ranks findings by CVSS, EPSS and known exploited vulnerability catalogues from CISA, ENISA and VulnCheck^[2]; KEV support needs version 5.1 or newer^[3]	CISA KEV checked daily. Each finding gets a priority from P1 to P4 based on exploitation, exposure and environment, with one sentence on why
Fix tracking and verification	An audit trail of analysis state, justification and comments for each finding; vulnerability policies to apply triage decisions across the portfolio; re-analysis on a schedule^[2]	One card per upgrade, with the version to move to and every issue it clears. Check again asks the agent for a fresh report and records passed, partly fixed or still open. Reports count only real fixes
Alerts and integrations	Slack, Microsoft Teams, Mattermost, Webex, email, Jira, webhooks and Kafka; DefectDojo, Fortify SSC and Kenna Security; community integrations for Jenkins, GitHub Actions, Azure DevOps, Maven and Backstage^[2]	Slack, Microsoft Teams, email, webhooks and Jira
Sign-in	OpenID Connect or LDAP, teams with fine-grained permissions, and, from version 5.2, service accounts and workload identity federation^[2]^[8]	Built-in accounts and API tokens; single sign-on with OpenID Connect or SAML in Pro and Enterprise
Deployment	Self-hosted container images with PostgreSQL as the only external service, scaling out with more instances^[2]. For production it suggests 2 GB of memory and 4 CPU cores per instance, at least two instances, and PostgreSQL on its own host starting at 8 GB and 4 cores^[4]	Self-hosted with Docker Compose or a Helm chart (2 CPU, 2 GB of memory and 10 GB of disk for a few hundred assets), or hosted as Stackurity Cloud
Licence	Apache-2.0, an OWASP project^[1]^[2]	Apache-2.0 core. Automatic fixing, evidence reports, several teams and single sign-on are paid Pro features
Pricing	Free under the Apache 2.0 licence, running on your own infrastructure^[2]	Community: free forever, self-hosted. Stackurity Cloud: 14-day free trial, then from $10 a month
AI assistant (MCP)	Not covered in the docs we checked	Built-in MCP server with OAuth sign-in, for Claude, ChatGPT, Cursor, VS Code and other MCP clients. Read-only unless you allow changes

Dependency-Track details checked on 29 Oct 2026 against its version 5 documentation; the numbers in brackets link to the sources. Stackurity details: compatibility, editions, AI assistants and pricing.

Where Dependency-Track is stronger

A portfolio of SBOMs. It is built to track every version of every project from the BOMs your pipelines and suppliers produce, with portfolio-wide search for every project a component or vulnerability affects^[2].
Policies and licences. Licence compliance with licence groups, security and operational rules, custom conditions in CEL, and a review flow for violations^[2]. Stackurity focuses on vulnerabilities and end of life, not licences.
VEX and VDR. It exchanges VEX documents with customers and suppliers and exports vulnerability disclosure reports^[2]^[5].
More exploitation and vulnerability data. Besides CISA KEV it can use ENISA and VulnCheck KEV catalogues and EPSS, and it can add analyzers such as Sonatype OSS Index, Snyk and VulnDB^[2]^[3]. Stackurity uses CISA KEV and EPSS, not the ENISA or VulnCheck catalogues or commercial analyzers.
Sign-in and access at no cost. OpenID Connect, LDAP, team permissions, service accounts and workload identity federation are part of the open-source product^[2]^[8]. In Stackurity, single sign-on is a paid feature.
A long track record. It is an established OWASP project now in its fifth major version^[1]^[2].

Where Stackurity is stronger

It finds the inventory itself. The read-only agent reads what is installed on each Linux server, including runtimes installed by hand and the libraries deployed applications actually load, so you do not need an SBOM pipeline for every server. Imported SBOMs are supported too.
End of life, not just outdated. It tracks end-of-life dates for operating systems, runtimes, Kubernetes and AWS managed services, and knows when a distribution still patches a package whose upstream version has ended.
A priority with a reason. CISA KEV, exposure and environment set a P1 to P4 priority, and each finding says in one sentence why.
Fixes are verified on the host. Each upgrade is one card, and Check again asks the agent for a fresh report so you can see whether the fix really landed.
Small to run, or hosted. The server needs 2 CPU and 2 GB of memory for a few hundred assets, or you can use Stackurity Cloud from $10 a month.
AI assistants. A built-in MCP server lets Claude, ChatGPT, Cursor or VS Code ask what is vulnerable and what to upgrade.

Which should you choose?

Choose Dependency-Track if

your builds and suppliers already produce CycloneDX BOMs and you want one portfolio view of them;
licence compliance, VEX or policies across security, licence and operational risk are requirements;
you want EPSS, several KEV catalogues, or commercial analyzers such as Snyk and VulnDB;
you need OpenID Connect or LDAP sign-in without paying for a licence.

Choose Stackurity if

your main question is what is running on your servers and deployed applications, and what to upgrade first;
you need end-of-life tracking for operating systems, runtimes, Kubernetes and AWS managed services;
you want proof from the server that each fix landed;
you would rather not maintain an SBOM pipeline for every server, or you want a hosted option.

Using them together

The two tools exchange SBOMs. Stackurity exports any asset’s inventory as a CycloneDX 1.6 SBOM, and Dependency-Track accepts every version of the CycloneDX specification for upload^[5], so what Stackurity’s agent finds on a server can go into Dependency-Track’s portfolio and licence policies:

stackurity sbom export --asset 12 -o asset.cdx.json

In the other direction, Stackurity imports CycloneDX or SPDX JSON, so the SBOMs your builds already produce for Dependency-Track can also go to Stackurity for end-of-life tracking and fix verification:

stackurity sbom import app.cdx.json

See Installing for the SBOM commands and the API guide for the matching endpoints.

Questions

Is Stackurity an alternative to OWASP Dependency-Track?

For some teams. If your main question is what is running on your servers and what to upgrade first, Stackurity covers it without a separate SBOM pipeline. If you rely on Dependency-Track’s licence policies, VEX or a portfolio of BOMs from many suppliers, keep it and add Stackurity for servers and end of life.

Does Dependency-Track scan servers directly?

Dependency-Track analyses the CycloneDX BOMs it receives; its documentation describes BOM uploads rather than an agent for hosts. To track a server with it, you would produce a BOM for that server with another tool and upload it. Stackurity’s read-only agent reads the server’s packages itself.

Can Stackurity import the SBOMs I already make?

Yes. Stackurity imports CycloneDX or SPDX JSON with stackurity sbom import or the API, matches the components against vulnerability advisories, the CISA KEV catalogue and end-of-life data, and can export any asset as CycloneDX 1.6.

Do Dependency-Track and Stackurity use CISA KEV?

Yes. Dependency-Track 5.1 and newer can mirror the CISA, ENISA and VulnCheck KEV catalogues and also uses EPSS. Stackurity checks CISA KEV and FIRST EPSS daily and combines them with exposure and environment to set a P1 to P4 priority.

Do both track end of life?

Dependency-Track flags outdated components, meaning a newer version exists, and its policies can flag old components. Stackurity tracks end-of-life dates for operating systems, runtimes, Kubernetes and AWS managed services, and does not flag a distribution’s own patched package just because the upstream version ended.

Which one is free?

Both can be self-hosted for free under Apache-2.0. Stackurity Community is free forever with all detection features; Stackurity Cloud is hosted, with a 14-day free trial and plans from $10 a month.

Try Stackurity on what you run

Start a 14-day free trial of Stackurity Cloud, no card needed, or download the free Community edition and run it on your own server.

Start free trial Download

Sources

Details of other products were checked on 29 Oct 2026 against their own documentation, websites, pricing pages and GitHub READMEs, listed below. Products change; follow the links for the current details. Details of Stackurity come from its documentation and pricing. Product names are trademarks of their owners and are used here only to refer to their products.