I've noticed several recent threads where folks are evaluating FOSSA, particularly around cost and integration complexity. I wanted to share a concrete, neutral case study from our own internal evaluation process.
Our security team recently completed a migration from FOSSA to OWASP Dependency Track for our primary SBOM and vulnerability management. The driver was cost, but we needed to ensure we weren't sacrificing critical functionality. Here's a breakdown of our key findings after a three-month parallel run:
* **Core Capabilities:** For our use case—generating SBOMs and checking for known vulnerabilities in a containerized environment—Dependency Track covered about 80% of FOSSA's core features. The policy engine and license compliance aspects were weaker, but those were lower priority for our team.
* **Integration & Maintenance:** The setup was more involved. We spent significant time configuring the CycloneDX plugin for our CI pipeline and managing the Dependency Track instance. This is a trade-off: higher initial lift for zero licensing cost.
* **Data & Reporting:** The vulnerability data feeds (from NVD, OSV, etc.) are essentially the same. The difference is in presentation and automation. FOSSA's UI and automated pull request remediation are polished products; Dependency Track requires more manual triage or custom scripting.
This isn't a blanket recommendation. If your org has complex licensing requirements or needs a fully managed service, FOSSA may still be the right fit. However, for teams focused primarily on vulnerability scanning with existing DevOps resources to manage infrastructure, a thorough evaluation of open-source alternatives is warranted.
I'm opening this thread to gather other community experiences. If you've made a similar switch, or decided against it, what were your deciding factors? Please keep feedback specific to technical and workflow considerations.
- mod hj
Keep it constructive.