Ortelius

Ortelius connects software bills of materials (SBOMs) with Helm and deployment metadata to show which open-source packages and versions reach deployed endpoints. It accepts SPDX and CycloneDX SBOMs, and can create an SBOM with Syft if one is missing. The platform checks inventory against OSV.dev vulnerability information every ten minutes, tracing an affected package and version through its artifact and deployment to the endpoint. Its post-deployment security dashboard brings together project security signals, versioned SBOMs, live deployments and vulnerability detection. Ortelius also correlates OpenSSF Scorecard results with deployed packages and versions, and describes continuous alignment with NIST 800-218 SSDF. Ortelius OS is available as SaaS or on-premises/self-hosted software, with REST and GraphQL APIs protected by JWT middleware. Its GitHub App supports installation connections and repository onboarding, but onboarding does not attach an SBOM. The free Ortelius OS plan costs nothing and covers up to 5 components, with unlimited users and endpoint tracking. DeployHub Enterprise costs $40 a month, billed $40 / component / month.

Ortelius focuses on connecting component inventory to deployments so teams can follow vulnerability exposure to endpoints. The free plan has a five-component limit; broader coverage is available through a separately priced Enterprise plan.

It suits teams that need to connect SBOM inventory to deployed software and trace vulnerabilities to affected endpoints. Teams can use its hosted service or self-host the software.

Overview

Ortelius is software supply-chain security software for teams that need to connect component inventories with real deployments. It is best suited to organizations tracking open-source exposure across running endpoints; its main advantage is following a finding to affected systems, while setup requires an SBOM as well as release and deployment data.

Key features

Ortelius accepts SPDX and CycloneDX SBOMs and can generate one with Syft when an inventory is missing. Its GitHub App imports release and deployment metadata, but does not attach an SBOM, so repository onboarding alone will not produce a complete component view. Teams can use the CLI in CI/CD pipelines to capture supply-chain data at build and deployment stages.

It checks OSV.dev vulnerability intelligence every ten minutes and remaps findings against deployed SBOMs on that interval. A finding can be traced from package and version through artifact and deployment to endpoint, which helps teams prioritize remediation by affected systems rather than relying on a dependency list alone.

The post-deployment security dashboard connects project security signals, versioned SBOMs, live deployments and vulnerability detection. Ortelius also correlates OpenSSF Scorecard results with deployed packages and versions, and describes continuous alignment with NIST 800-218 SSDF. Its deployment-aware software digital twin keeps component visibility connected to where software runs.

Pricing

Ortelius OS Free: free, with up to 5 components, unlimited users, unlimited endpoint tracking and community support. This is a practical starting point for small inventories or evaluation, but the component cap limits it as coverage expands.

DeployHub Enterprise: $40 a month, billed $40 / component / month. It offers pay-as-you-grow component coverage, group-level access controls, SaaS or self-hosted deployment and commercial support. The per-component charge can make larger inventories costly, but avoids the fixed five-component ceiling and adds organizational access controls missing from the free tier.

Both plans support SBOM standards and deployment models, vulnerability analysis, license analysis, SBOM exchange and release monitoring. The free offering has user-level access controls; Enterprise adds group-level controls and LDAP/Active Directory support.

Platforms

Ortelius is available through a free SaaS version or as on-premises/self-hosted software, and exposes REST and GraphQL API endpoints protected by JWT middleware. A hosted version at app.deployhub.com requires no infrastructure setup. Community questions are supported through Discord and GitHub issues; DeployHub Enterprise includes commercial technical support.

Who it's for

Ortelius fits teams that need to know which deployed systems contain vulnerable components and already have—or can establish—a process for supplying SBOMs. The free plan suits a small component inventory with broad user and endpoint access. Teams needing more than five components, group-level governance or commercial support should consider Enterprise. It is a weaker fit for teams expecting a GitHub connection alone to attach inventory automatically.

Pros and cons

• Pros: Ten-minute vulnerability remapping and package-to-endpoint tracing connect newly disclosed issues to systems that may need action.
• Pros: SPDX and CycloneDX support, plus Syft generation, provide multiple paths to component inventory.
• Pros: Unlimited users and endpoint tracking on the free plan make small deployments less constrained by access or endpoint counts.
• Cons: The free plan stops at five components, limiting its usefulness as inventory grows.
• Cons: GitHub onboarding imports release and deployment metadata but leaves SBOM attachment as a separate step.
• Cons: Enterprise is priced per component per month, so broader coverage increases recurring cost.

Alternatives

For a broader comparison of inventory tools, see SBOM Management Software.

• Keysight Eggplant Test is a paid enterprise option with a free trial and a quote-based plan; consider it when that model and its broad platform coverage suit your selection process.
• Exodos Labs offers a freemium model and a Community plan at no cost with one user, one API key and unlimited inventories; consider it when an inventory-focused free tier is a better fit.
• ReARM has a free-forever self-hosted community edition for a single organization, with core SBOM/XBOM storage and retrieval; choose it when those storage and retrieval needs take priority.
• Sonatype Nexus Repository offers a free Community Edition with full ecosystem support, CI/CD integration and an external PostgreSQL option; consider it when repository management and CI/CD integration are the deciding needs.
• CAST SBOM Manager provides a free download for Linux and Windows; consider it when a downloadable tool on those platforms fits better.
• FOSSA offers a free tier limited to five projects, ten contributing developers, one release group and five dependency levels for scans; consider it when those project and scan limits fit your use.
• Interlynk has a free Community Tier with no per-seat fees or per-SBOM metering; consider it when avoiding those charges matters most.
• OTNOS SBOM 360 has a free plan with 50 monitored assets and one user, alongside CSV import and daily monitoring limits; consider it when that asset allowance and monitoring cadence suit your needs.

Verdict

Choose Ortelius if your priority is tracing open-source vulnerability exposure from SBOM components to deployed endpoints, especially when a five-component free tier is sufficient to start. Look elsewhere if you need GitHub onboarding to supply SBOMs automatically or require broader coverage without per-component Enterprise pricing.