Comparison
Threat Detective vs OWASP Dependency-Track.
Bring your SBOMs, vulnerability assessments and submission evidence into one hosted platform.
Already using Dependency-Track to store SBOMs and monitor vulnerabilities? Threat Detective covers those needs and adds medical-device assessment, documented decisions and regulatory reporting. Your team manages the device’s cybersecurity. We run the platform.
The short answer
Dependency-Track is a capable open-source platform for component inventory, vulnerability monitoring and software supply-chain policy.
For a medical-device team, the work also includes assessing findings in the context of the device, recording mitigations and residual risk, maintaining component support information, and preparing evidence for review.
Threat Detective brings that work together. If you currently use Dependency-Track alongside assessment spreadsheets and report templates, you can replace that workflow with a hosted platform built for medical devices.
Dependency-Track
Open-source SBOM vulnerability platform
An OWASP flagship project used across industries to inventory software components and watch them for known vulnerabilities. Self-hosted, API-first, and built to sit in an engineering pipeline.
- CycloneDX SBOM and VEX in and out
- NVD, GitHub Advisories, OSV, OSS Index and more, with EPSS scores
- CISA and ENISA KEV catalogues from version 5.1
- Policy engine for security, licence and operational rules
- Audit workflow with analysis states and justifications
- Slack, Teams, email, webhook and Jira notifications
- Free licence. You provide the servers and the hours
Threat Detective
Medical device cybersecurity evidence
Built for medical device manufacturers who have to produce cybersecurity documentation for a submission and keep it current afterwards. It starts from the SBOM you already have and ends with what the reviewer reads.
- SBOM validation against the NTIA minimum elements
- Guided vulnerability scoring with the MITRE CVSS rubric for medical devices
- Decision records with rationale, mitigations and residual risk
- Documents for the eSTAR cybersecurity section and Notified Body review, generated from the recorded assessments
- Track component support status and end-of-life dates
- Post-market surveillance across every released version
- Hosted, $189/month per device Pre-Market, $249/month Post-Market
- Unlimited team members on every plan
Compare the workflows your medical-device team needs
Eight parts of the workflow, and how each tool handles them.
eSTAR cybersecurity documentation
- Dependency-Track
- Not a feature. You assemble the sections by hand from SBOM, finding and audit exports.
- Threat Detective
- Generated from the recorded assessments: documents for the eSTAR cybersecurity section, with the evidence attached.
Vulnerability scoring
- Dependency-Track
- CVSS as published by the source, with EPSS for exploit likelihood.
- Threat Detective
- Guided scoring with the MITRE medical device rubric, recorded as evidence.
CISA KEV
- Dependency-Track
- Mirrored from 5.1.0 (August 2026), with KEV-driven policies and notifications. On 4.x it means the 5.x migration first.
- Threat Detective
- Rechecked continuously. A closed decision reopens when its vulnerability is listed later.
Component support status and end-of-life
- Dependency-Track
- Not tracked.
- Threat Detective
- Support status and end-of-life date on every component. From endoflife.date where covered, entered by you where not.
Vulnerability decisions
- Dependency-Track
- Audit workflow: analysis state, justification and comments per finding.
- Threat Detective
- Decision record: rationale, mitigations and residual risk per finding, written for the reviewer, with an audit trail.
VEX
- Dependency-Track
- CycloneDX VEX import and export.
- Threat Detective
- CycloneDX VEX generated from the decisions already recorded.
Post-market surveillance
- Dependency-Track
- Continuous monitoring with Slack, Teams, email and Jira alerts. Each version is its own project.
- Threat Detective
- Every released version monitored. One decision carried across the versions it affects. Periodic post-market reports.
Hosting
- Dependency-Track
- You run it: API server, frontend and PostgreSQL, plus feeds, backups and upgrades.
- Threat Detective
- We run it. Nothing to install or patch. Private cloud available.
Dependency-Track capabilities checked against Dependency-Track 5.1, September 2026, using the project documentation and release announcements. Dependency-Track moves quickly. If something here is out of date, tell us and we will correct it.
Compare the full cost of the workflow
Dependency-Track has no licence fee. Your team provides the hosting, upgrades, backups and feed maintenance, along with the medical-device assessment and reporting process around it.
Running Dependency-Track
Licence: free. Everything else: yours.
- Servers
- Modest: the documented minimum is 2 cores and 2GB for the API server, plus a frontend container and a PostgreSQL database. It has to stay up for as long as the device is on the market.
- Setup
- Deployment, the initial NVD and advisory mirror, single sign-on, access control and the integrations you want for alerts.
- Securing it
- The service holds your component inventory and vulnerability findings. Network placement, TLS, patching the host and the containers, and backups that you have restored at least once.
- Keeping the feeds fresh
- The vulnerability mirrors and EPSS scores update on a schedule you own. Monitor feed updates so failed jobs do not leave vulnerability data out of date.
- Upgrades
- Point releases are in place. The move from 4.x to 5.x is not: 5.x needs its own PostgreSQL cluster, an offline one-time migration and a maintenance window.
- An owner
- Someone who is paged when it goes down, applies the upgrades, and can explain the setup when an auditor asks.
- Assessment and reporting
- The spreadsheets, templates and hours that turn findings into a record a reviewer can read, kept current for each release.
Threat Detective
Per medical device, hosted
- Pre-Market
- $189/month
- Post-Market
- $249/month
- Private Cloud
- $1,495/month
12-month contract, 5 devices
Platform operation is included in the subscription: the servers, the feeds, the upgrades, the backups and the person on call. Unlimited team members on every plan, so QA, RA and engineering work from one record.
Data is hosted on dedicated servers at Hetzner in Falkenstein, in the EU, with daily encrypted backups. Private Cloud adds a choice of EU, UK or US residency, and we still operate it. Security posture, subprocessors and the disclosure policy are on the trust page.
See full pricing details, including GBP and EUR.
Compare that subscription with both the cost of operating your current platform and the time spent maintaining assessments and preparing reports.
Does Threat Detective replace Dependency-Track?
Yes, if you use Dependency-Track for your medical-device SBOM inventory and vulnerability monitoring. Threat Detective provides those capabilities alongside medical-device assessments, reporting and post-market surveillance.
If your organisation also relies on Dependency-Track for broader licence policies or custom engineering integrations, include those requirements in your evaluation.
Weighing other tools? See how Threat Detective compares to Snyk, Dependabot and Ketryx.
Try it with one device release
Evaluate before you migrate. One release is enough to see the difference, and Threat Detective reads the CycloneDX that Dependency-Track exports.
Export an SBOM
Choose a release in Dependency-Track and export its CycloneDX SBOM.
Assess your findings
Upload it to your trial and work through the medical-device assessment workflow.
Compare the output
Generate documentation from the recorded assessments and compare it with the reports you prepare today.
No credit card required.
If you want help planning an evaluation or a move, our consulting service can advise.
Questions teams on Dependency-Track ask
Is Dependency-Track enough for an FDA premarket submission?
Not on its own. Dependency-Track supports component inventory, vulnerability monitoring and an audit trail of analysis decisions. Your team still needs to assess findings for the device and prepare the supporting submission documentation. Threat Detective brings medical-device scoring, decision rationale, mitigations and residual risk into one workflow, then generates documents from those recorded assessments. For the full list of what a submission needs, see the FDA SBOM readiness checklist.
What is a good Dependency-Track alternative for medical devices?
Threat Detective is an alternative for teams that want hosted SBOM inventory and vulnerability monitoring alongside medical-device assessment and reporting. It works with your existing SBOMs, guides vulnerability scoring with the MITRE medical-device CVSS rubric, and generates regulatory documents and VEX from recorded decisions. Hosting, updates and backups are included. See what it produces on the features page.
Does Dependency-Track track CISA KEV?
Yes, from version 5.1.0, released on 31 August 2026. It mirrors the CISA and ENISA catalogues and adds a KEV column, filter, policy condition and notification filter. Earlier releases do not have it. If you are on 4.x, reaching KEV means the move to 5.x, which is not an in-place upgrade: 5.x runs on its own PostgreSQL cluster and imports 4.x data through a one-time offline migration. Threat Detective checks KEV continuously on every plan and reopens a closed decision if its vulnerability is later listed.
What happens to our evidence if we stop using Threat Detective?
You can export at any time: the SBOM as CycloneDX or SPDX, the VEX as CycloneDX, and the generated documents as files. After cancellation the data stays available for export for 30 days, then it is deleted and purged from backups within 90 days. Retention and deletion are set out on the trust page.
What does it cost to run Dependency-Track?
The licence is free. The servers are modest: the documented minimum is 2 cores and 2GB for the API server, plus the frontend and a PostgreSQL database with backups. Add the vulnerability feed mirroring, single sign-on and access control, monitoring, and someone to apply upgrades. Major upgrades add a maintenance window. For a small manufacturer without a platform team, the largest line is usually the hours, not the servers. Compare that with the per-device pricing.
See what changes after the vulnerability alert.
Use your own SBOM to explore medical-device assessment, documented decisions and regulatory reporting in Threat Detective. Nothing to install and no credit card.