Wisec
Saint-Priest, France
What it is
Wisec collects, signs, and preserves software build evidence to support Cyber Resilience Act readiness. It links builds in a signed chain using Ed25519, SLSA provenance, and public Sigstore/Rekor timestamping. The service creates signed CycloneDX SBOMs and VEX documents describing the exploitability status of detected CVEs. Eleven anomaly rules run on each build, including checks calibrated to project history and known-bad patterns. Teams can set CI gate rules to block or warn on secrets, vulnerable dependencies, unapproved contributors, risk thresholds, and CVE severity. Wisec supports GitLab CI, GitHub Actions, Jenkins, and Azure DevOps, and imports SARIF v2.1.0 findings from CodeQL, Semgrep, Snyk, Trivy, or compatible tools. It maps evidence to NIS2, SOC2, ISO 27001, and CRA and can export PDF reports; for CRA and ISO 27001, the mapping is evidence support rather than a conformity claim. The maker says data is encrypted in transit and at rest, hosted in France, and kept within the EU. The open-source Apache-2.0 agent runs in CI without cloning repositories. Plans include a free tier, paid founder-rate options, and Enterprise custom pricing.
For and against
For
- Generates signed CycloneDX SBOMs and VEX documents
- CI policies can block or warn on defined risks
- Imports SARIF findings from compatible scanners
- Open-source CI agent runs without cloning repositories
- Self-hosting is available to Enterprise customers
Against
- CircleCI and Travis CI support is listed as coming soon
- Enterprise pricing requires a custom quote
- Business and Pro list founder rates, with higher standard rates from 2027
The verdict
Wisec focuses on signed build evidence, scanner findings, policy gates, and compliance evidence mapping. Its plans range from a free option to paid founder-rate plans and custom Enterprise pricing.
Who it suits
It suits software teams that need signed build evidence, SBOMs, VEX documents, and CI policy gates. Free is described for small projects and security exploration, while self-hosting is available to Enterprise customers.
Plans and prices
Free
3 projects · 1,000 builds/month · 30 days history · 1 PDF certificate/month
Read 5 Oct 2026 · wisec.io
Business
10 projects · 20,000 builds/month · 1 year history · Email support (48h response)
Read 5 Oct 2026 · wisec.io
Pro
Unlimited projects and builds · Lifetime archives · Priority support (24h response)
Read 5 Oct 2026 · wisec.io
Enterprise
Unlimited projects and builds · On-premise or private cloud deployment · Dedicated 24/7 priority support · Custom billing
Read 5 Oct 2026 · wisec.io
On the record
- Anomaly detection
- Eleven rules run on every build, including five calibrated to project history and six for known-bad patterns.wisec.io · read 5 Oct 2026
- CI integrations
- Dedicated CI/CD support is listed for GitLab CI, GitHub Actions, Jenkins, and Azure DevOps; CircleCI and Travis CI are described as coming soon.wisec.io · read 5 Oct 2026
- Compliance evidence
- Wisec maps evidence to NIS2, SOC2, ISO 27001, and CRA and can export audit-ready PDF reports; for CRA and ISO 27001 it says this is evidence mapping, not a conformity claim.wisec.io · read 5 Oct 2026
- Cryptographic records
- Builds are linked in a chain and signed with Ed25519, with SLSA provenance and public Sigstore/Rekor timestamping.wisec.io · read 5 Oct 2026
- Open-source agent
- The CI agent is open source under Apache-2.0, while the platform is managed and hosted in the EU.wisec.io · read 5 Oct 2026
- Policy gate
- Users can define block or warn policies for secrets, vulnerable dependencies, unapproved contributors, risk thresholds, and CVE severity, enforced at the CI gate.wisec.io · read 5 Oct 2026
- Purpose
- Wisec collects, signs, and preserves software build evidence such as provenance, SBOM, SLSA, and VEX for Cyber Resilience Act readiness.wisec.io · read 5 Oct 2026
- SBOM and VEX
- It generates signed CycloneDX SBOMs and signed VEX documents describing the exploitability status of detected CVEs.wisec.io · read 5 Oct 2026
- Scanner imports
- Wisec imports SARIF v2.1.0 findings from CodeQL, Semgrep, Snyk, Trivy, or other SARIF-compatible tools.wisec.io · read 5 Oct 2026
- Security and residency
- The maker says data is encrypted in transit and at rest, platform data is hosted in France, and data residency is 100% in the EU.wisec.io · read 5 Oct 2026
- Self-hosting
- Self-hosting is available to Enterprise customers, with on-premise or private cloud deployment listed.wisec.io · read 5 Oct 2026
- Source code handling
- Wisec says its agent runs in CI and does not clone repositories; since agent v1.2.0 it withholds scanner-quoted code before sending findings.wisec.io · read 5 Oct 2026
- Support
- Free includes community support, Business lists email support with a 48-hour response, Pro lists priority support with a 24-hour response, and Enterprise lists dedicated 24/7 priority support.wisec.io · read 5 Oct 2026
- Target users
- The Free plan is described for small projects and security exploration, Business for growing teams requiring notarization, and Pro for organizations demanding full control.wisec.io · read 5 Oct 2026
