Managed Dependency-Track

What is Dependency-Track?

Dependency-Track is an OWASP flagship platform for software supply chain security. It ingests SBOMs and continuously monitors your components for known vulnerabilities, outdated libraries, and license risk, even long after a build has shipped.

Use cases

• → NIS2 and DORA software supply chain risk management
• → Continuous SBOM monitoring after release
• → License compliance across application dependencies
• → Complement to DefectDojo for full vulnerability coverage

Features

• SBOM ingestion (CycloneDX, SPDX)
• Continuous component vulnerability monitoring
• License risk and policy violation tracking
• Sourced from NVD, OSV, and GitHub Advisories
• Policy engine for security and license gates
• REST API and CI/CD pipeline integration
• Per-project risk scoring and dashboards
• Feeds findings into DefectDojo