FOSSA
San Francisco, California, United States
What it is
FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality standards, including rules that block builds. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. FOSSA notes that Quick Import does not run the build and returns less complete results than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. Deployment options include customer-operated on-premises installation using Kubernetes and Helm. The Free plan costs nothing and includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed. FOSSA describes its documentation as serving developers, security teams, and legal counsel.
For and against
For
- Analyzes open-source dependencies across more than 30 languages.
- Policy rules can block builds.
- Supports SBOM generation, import, export, and management.
- Documents integrations with GitHub, Jira, Slack, and others.
- Offers customer-operated on-premises deployment.
Against
- Quick Import results are less complete than CLI scans.
- Free plan limits projects and imported SBOMs.
- Enterprise pricing is custom and not listed.
The verdict
FOSSA brings dependency, vulnerability, license, and SBOM workflows together, with multiple scanning methods and deployment options. Teams should account for the stated Quick Import limitation and review plan limits and pricing for their needs.
Who it suits
FOSSA suits developers, security teams, and legal counsel working with software dependencies, vulnerabilities, licenses, or SBOMs. Its deployment options include a customer-operated on-premises setup.
Plans and prices
Free
5 projects · 10 contributing developers · 1 release group · 5 dependency levels for scans
Read 2 Oct 2026 · fossa.com
Business
10 projects / SBOM imports · 10 contributing developers · 1 release group · Unlimited dependency levels
Read 2 Oct 2026 · fossa.com
Enterprise
Unlimited projects · Custom developer count · Unlimited release groups and dependency levels · Enterprise SLAs
Read 2 Oct 2026 · fossa.com
On the record
- Company history
- FOSSA says organizations have used its software since 2015.fossa.com · read 2 Oct 2026
- Dependency scanning
- FOSSA advertises open source dependency analysis for more than 30 languages.fossa.com · read 2 Oct 2026
- Deployment
- FOSSA documents an on-premises deployment that customers can operate in their own infrastructure using Kubernetes and Helm.docs.fossa.com · read 2 Oct 2026
- Import limitation
- FOSSA says Quick Import scans source without running the build and produces less complete results than a CLI scan.docs.fossa.com · read 2 Oct 2026
- Integrations
- Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers.docs.fossa.com · read 2 Oct 2026
- Intended users
- FOSSA describes its documentation as serving developers, security teams, and legal counsel.docs.fossa.com · read 2 Oct 2026
- Policy enforcement
- Its policy engine supports organization-wide license, security, and quality standards, including build-blocking enforcement.fossa.com · read 2 Oct 2026
- Purpose
- FOSSA scans software to identify dependencies, vulnerabilities, and license issues across the software development lifecycle.fossa.com · read 2 Oct 2026
- SBOMs
- FOSSA supports generating, importing, exporting, and managing SBOMs; the pricing page lists a limit of five imported SBOMs on Free.fossa.com · read 2 Oct 2026
- Scanning methods
- FOSSA supports CLI and CI/CD scanning, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads.docs.fossa.com · read 2 Oct 2026
- Security
- FOSSA's Trust Center lists SOC 2 compliance and controls including data encryption and penetration testing.fossa.com · read 2 Oct 2026
- Support
- The Free plan includes basic email support, while Business includes priority support.fossa.com · read 2 Oct 2026
