Provetry vs Dependency-Track: which one for the CRA?
On this page
OWASP Dependency-Track is the reference open source platform for SBOM management: you feed it SBOMs, it keeps an inventory of every component across your portfolio and checks them continuously against vulnerability data. Provetry covers part of the same ground, but it is built around one regulation, the Cyber Resilience Act, and the duties that come with it. Provetry opens in November 2026; Dependency-Track is available today. This page sets out what each does, as of November 2026, so you can pick the right one, or both.
In one sentence
Dependency-Track is a free, self-hosted platform to track components and vulnerabilities at scale. Provetry is a hosted service that takes a product from its lock files to its CRA duties: SBOM, exploited-vulnerability watch, the Article 14 reporting deadlines, the disclosure policy and the technical documentation.
Side by side
For Provetry, the plan that includes each feature is given in brackets. Prices exclude VAT.
| Dependency-Track | Provetry | |
|---|---|---|
| Availability | Available | Opens in November 2026 |
| Model | Open source (Apache 2.0, OWASP), self-hosted | Hosted service |
| Price | Free; you pay for the servers and the time to run them | Free for one product, then €49, €149 or €399 a month |
| SBOM input | CycloneDX SBOMs produced by your build or your suppliers | Lock files of 8 ecosystems, or CycloneDX and SPDX SBOMs in JSON; from CI on paid plans |
| SBOM output | CycloneDX, up to 1.7 | CycloneDX 1.6 (all plans; up to 3 releases on Free); SPDX 2.3 and 3.0.1 (paid plans) |
| Known exploited vulnerabilities | CISA KEV and ENISA’s EU list, since version 5.1 (August 2026); VulnCheck’s list optional | CISA KEV and ENISA’s EU list (EUVD) |
| EPSS | Yes | Yes |
| VEX | Imports and exports CycloneDX VEX | Records your assessments and exports OpenVEX (all plans); public VEX feed (paid plans) |
| Reachability | No | Suggestions from your CI, with evidence (paid plans): Go function level, package level elsewhere; npm, PyPI and Java function level for the advisories mapped so far (Pro and Consultant) |
| Policies and licences | Policy engine, licence compliance | No licence compliance |
| Article 14 reporting to ENISA | No | Reporting case opened from the moment you became aware, deadlines counted down, drafts that follow the fields of ENISA’s platform (paid plans) |
| Disclosure policy, contact address, CSAF advisories | No | Yes, with a public security page per product (paid plans) |
| CRA technical documentation | No | Guided dossier and draft EU declaration of conformity (Pro and Consultant) |
| Scale | Built for large portfolios, high availability since 5.0 | Small and mid-sized manufacturers, up to 50 products |
Where Dependency-Track is the better choice
- You want to host everything yourself, for internal policy or sovereignty reasons, and you have someone to run it. Version 5.0 (June 2026) needs PostgreSQL and two containers; it scales horizontally and has no licence cost.
- You manage a large portfolio of applications, with policies across teams, licence rules and integrations into Jira, DefectDojo, Slack or Teams.
- Your SBOMs already exist in CycloneDX, produced by your build or received from suppliers, and you mainly need a place to store and watch them.
Where Provetry is the better choice
- The CRA is your reason for doing this. Dependency-Track tells you that a component has an exploited vulnerability. Provetry also lets you open a reporting case from the moment you became aware, counts down the Article 14 deadlines, prepares the early warning, the notification and the final report in the shape ENISA’s platform asks for, and records who decided what and when.
- You have no SBOM pipeline yet. Provetry builds the SBOM from the lock files you already have, at every release, and keeps each release’s SBOM separate.
- You need the documents around the SBOM. The disclosure policy and the contact address for reports the CRA expects (for example in
security.txt), CSAF security advisories, a public VEX feed, the technical documentation of Annex VII and a draft EU declaration of conformity. - You do not want to run a server. No database to back up, no upgrade window.
Using both
They do not exclude each other. A team can keep Dependency-Track as its internal inventory and use Provetry for the products placed on the EU market and their CRA file. Both read standard CycloneDX JSON, so the same SBOM can go to each.
What to check before choosing
- Who will operate it? A self-hosted platform is only free if someone has time to apply its updates, back it up and upgrade it. The move from version 4 to 5 needed a one-off migration and a maintenance window.
- Who will write the ENISA reports? Under Article 14, an early warning is due within 24 hours of becoming aware of an actively exploited vulnerability in your product. Decide now which tool, and which person, will produce it.
- Is your product even in scope? Many SaaS products are not. The free check tells you in a few minutes.
Dependency-Track is an OWASP project. Provetry is not affiliated with OWASP or the Dependency-Track project. The facts above were checked in November 2026 against the sources below; if something has changed, tell us at hello@provetry.com and we will correct it.