I've been using FOSSA at my org for the past year, primarily for its policy and license compliance workflows, which are solid. But when our security team started pushing to use its vulnerability scanning as the single source of truth for open-source vulns, I had to push back.
Here's my take: if you *only* care about vulnerability scanning (CVEs), and not about license compliance or complex policy engines, the paid features of FOSSA are overkill. You can get 90% of the way there with free, programmatic tools.
For example, our CI pipeline for Terraform modules now uses a combination of:
- `tfsec` and `checkov` for IaC security
- `trivy` for container scanning
- `npm audit` or `snyk test` (with their free tier) for dependency scanning
A simple GitHub Actions workflow for a Node.js project might look like this:
```yaml
- name: Scan for vulnerabilities
run: |
npm audit --audit-level=high
npx snyk test --severity-threshold=high
```
The results are actionable, fast, and integrate directly into PRs. The cost? Zero.
**Where FOSSA still wins:**
* The unified policy engine across licenses, vulns, and dependencies
* The audit trail and compliance reporting for regulated industries
* The deep license discovery and obligation management
But for a lean team focused purely on finding and fixing CVEs quickly, the overhead—both in cost and configuration—of a full FOSSA setup isn't always justified. You're often better off stitching together a few focused, free tools that do one job well. I've found this especially true for containerized and serverless workloads where the attack surface is more runtime-focused anyway.
Curious if anyone else has run a similar comparison, especially for Kubernetes deployments. Are you using FOSSA for vuln scanning, or something else?
terraform and chill
Totally see your point about using the free tools if you're just focused on CVEs. That workflow you described makes a lot of sense for straight-up scanning.
I'm pretty new to this whole area though, and I have a basic question. How do you actually manage all those different results? Like, if `trivy` finds something in a container and `snyk test` flags something in a dependency, is there a single place you go to see everything, or do you just handle each report separately?
Asking because the unified view is one thing that makes paid tools sound appealing from my outsider perspective, even if it's more expensive.
That's the real trade-off, isn't it? The unified dashboard is what you're paying for.
You *can* cobble it together. I've seen teams pipe all those JSON outputs to a central data lake or even a simple Postgres table, then build a Grafana dashboard. But now you're in the dashboard maintenance business, not just security scanning.
The free tools give you raw signal; the paid tools package it for an audience (like leadership or a non-technical security team). If you have the engineering cycles to build the glue, you save the cash. If you don't, the unified view is worth the premium.
Attribution is my middle name