Dependency-Track

Dependency-Track is an open-source platform developed and maintained by OWASP that provides continuous software composition analysis (SCA) and vulnerability management. It ingests SBOMs in CycloneDX or SPDX format, maintains an inventory of all components across the manufacturer's product portfolio, and continuously correlates that inventory against vulnerability databases (NVD, OSV, GitHub Advisory, and others) to identify which components have known vulnerabilities. When a new CVE is published affecting a component present in any product's SBOM, Dependency-Track generates an alert and tracks the finding through its lifecycle. The platform provides a dashboard view of the manufacturer's overall vulnerability exposure across all products - the foundation of a scalable CRA-compliant vulnerability management operation.

Dependency-Track directly supports multiple CRA compliance activities:

• SBOM repository: Stores current SBOMs for all product versions, satisfying the Annex VII technical file requirement for SBOM retention.
• Continuous vulnerability monitoring: Automatically detects new CVEs affecting the product SBOM without requiring manual monitoring of vulnerability feeds.
• PSIRT triage feed: Generates vulnerability findings that can be fed into the PSIRT triage workflow, pre-populated with CVE details, CVSS scores, and component information.
• VEX integration: Dependency-Track supports importing VEX documents to suppress findings that have been assessed as not-affecting the product, maintaining an accurate risk posture without noise.
• Policy engine: Configurable policies can automatically escalate findings based on CVSS score, EPSS, or component criticality, enforcing triage SLAs automatically.

For maximum CRA compliance value, Dependency-Track should be integrated into the manufacturer's PSIRT workflow:

1. CI/CD integration: Configure the build pipeline to automatically upload the freshly generated SBOM to Dependency-Track on every release build.
2. Finding notifications: Configure Dependency-Track to send alerts to the PSIRT ticketing system when new Critical or High findings appear, triggering the triage workflow.
3. Policy-based escalation: Use Dependency-Track policies to automatically identify findings that meet CISA KEV criteria or have high EPSS scores, routing these to a fast-track triage queue.
4. VEX workflow: For findings assessed as not-affected, generate VEX statements in Dependency-Track and export them for publication in CSAF advisories.
5. Audit logging: Dependency-Track maintains an audit log of all findings, status changes, and analyst comments - this provides the documentary evidence of vulnerability handling that MSAs may request.

Dependency-Track is the leading open-source option in its category. Commercial alternatives include Snyk, FOSSA, Mend (WhiteSource), and Black Duck (Synopsys). Key considerations for CRA manufacturers:

• Cost: Dependency-Track is free and open-source; commercial tools have licensing costs that scale with portfolio size.
• Data freshness: Commercial tools typically have faster vulnerability database updates and proprietary intelligence feeds beyond NVD/OSV.
• Integration depth: Commercial tools often have deeper IDE, ticketing system, and CI/CD integrations out of the box.
• Support: Open-source means community support; commercial tools provide vendor SLAs.

For smaller manufacturers with limited budgets, Dependency-Track with commercial threat intelligence feed integration is a cost-effective path to CRA-compliant SCA. Larger manufacturers with complex portfolios often use commercial tools for their support and integration capabilities.