- Home
- Dependency Management Software
- FossID Workbench
FossID Workbench
Stockholm, Sweden
What it is
FossID Workbench is a paid software composition analysis tool for identifying and governing third-party software in codebases. It analyzes dependencies, unmanaged source and embedded open-source snippets across many ecosystems, including JavaScript, Java, Python, Rust, Go, C/C++, PHP, Ruby, .NET and others. ID Assist proposes component identifications, License Extractor finds file-level license text, and Vulnerable Snippet Finder links vulnerable code blocks to CVEs with VEX exploitability context. Workbench creates, imports, consolidates and exports SBOMs with SPDX or CycloneDX formats. Policy Management applies license, security and usage rules across projects. Integrations include GitHub, GitLab and Bitbucket, with CI/CD scanning, gating and pull-request notifications. Deployment options include cloud, hybrid, on-premises and offline air-gapped setups. FossID is headquartered in Stockholm and pricing is available on request.
For and against
For
- Scans dependencies and unmanaged source
- Generates SPDX or CycloneDX SBOMs
- Finds vulnerable code snippets
- Supports pull-request scanning and gating
- Offers cloud, hybrid and on-premises deployment
Against
- Pricing is available only on request
- Broad feature set may require specialist teams
- Offline deployment requires an air-gapped setup
The verdict
FossID Workbench brings code, license, vulnerability and policy analysis into one composition-analysis platform. Its deployment and integration choices support enterprise workflows, while buyers must request pricing.
Who it suits
This suits engineering, DevSecOps, legal, compliance and audit teams managing third-party code. It is aimed at enterprise software teams needing component, license and vulnerability oversight.
Plans and prices
FossID Workbench
Pricing not stated; contact FossID for a quote
Read 10 Oct 2026 · fossid.com
On the record
- Access management
- Workbench 26.2 added SAML single sign-on, working with user groups and SCIM synchronization.fossid.com · read 10 Oct 2026
- API
- The Workbench API supports custom workflows for scanning, gating, and notifying.fossid.com · read 9 Oct 2026
- Audience
- FossID describes its customers as enterprise software teams and says its users span engineering, legal, compliance, and security roles.fossid.com · read 10 Oct 2026
- Code detection
- Its scanning identifies open-source code snippets, including snippets as small as six lines, and is designed to detect code despite modifications.fossid.com · read 10 Oct 2026
- Company
- FossID says it was founded in 2016 and was reacquired by its founders in 2022 after being acquired by Snyk in 2021.fossid.com · read 9 Oct 2026
- Dependency analysis
- Workbench identifies direct and transitive dependencies from supported package manifests, while source scanning can find unmanaged code.fossid.com · read 10 Oct 2026
- Deployment
- FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option.fossid.com · read 10 Oct 2026
- Detection
- It analyzes dependencies, scans unmanaged source code regardless of programming language, and detects open-source snippets embedded in source files.fossid.com · read 9 Oct 2026
- Identification
- ID Assist proposes component identifications, and License Extractor detects and extracts file-level license text.fossid.com · read 9 Oct 2026
- Integrations
- Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications.fossid.com · read 10 Oct 2026
- Intended users
- FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams.fossid.com · read 9 Oct 2026
- M&A audits
- FossID describes a blind audit process that creates a one-way hash and does not require access to the target’s source code.fossid.com · read 9 Oct 2026
- Policy controls
- Policy management can enforce license, security, and software usage rules across projects.fossid.com · read 10 Oct 2026
- Policy management
- Policy Management can automatically enforce license, security, and usage policies across projects.fossid.com · read 9 Oct 2026
- Product
- FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases.fossid.com · read 9 Oct 2026
- Purpose
- FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases.fossid.com · read 10 Oct 2026
- SBOM
- Workbench can create SBOMs with component, license, vulnerability, and usage information and export them in SPDX or CycloneDX formats.fossid.com · read 9 Oct 2026
- SBOMs
- Workbench supports creating, importing, consolidating, and exporting SBOMs in SPDX and CycloneDX formats.fossid.com · read 10 Oct 2026
