Comparisons
See how ReARM compares to other tools in the supply chain security ecosystem
ReARM vs Dependency-Track 4
Dependency-Track is a great open-source tool for vulnerability analysis of SBOMs. ReARM integrates with Dependency-Track and builds on top of it, providing a comprehensive Release-Level Supply Chain Evidence Platform.
ReARM
Dependency-Track 4
Stores raw BOMs in both CycloneDX and SPDX formats, VEX, VDR, BOV, SARIF, signatures, attestations, build metadata, and any other artifacts per release.
Ingests CycloneDX SBOMs and performs vulnerability and policy violation analysis. Does not preserve raw artifacts.
Release-centric structure with versioned releases stored within Product-Component model with full release history, audit trail, and provenance details for each artifact.
SBOM-centric flat project structure.
Highly configurable auto-integration engine aggregating findings from multiple sources and from comopnents into products
Limited single-parent hierarchy.
Own finding audit engine with various scopes (organization-wide, product-level, feature set-level, component-level, branch-level, release-level). Supports all findings, including those from Dependency-Track and other sources.
Limited audit capabilities supporting SBOM-level only scope for Dependency-Track findings only.
Approval and lifecycle management for releases (ReARM Pro).
No release approval workflows.
Supports its own SBOM augmentation and enrichment logic (via Reliza's BEAR project). Stores augmented and enriched SBOMs alongside original raw SBOMs.
Relies on SBOM as provided.
Proprietary deduplication logic for SBOM data and findings significantly improves operability and reduces infrastructure footprint. ReARM tolerates full outage and data loss on Dependency-Track with an option to rebuild based on ReARM data.
Limited deduplication logic for findings only. Significantly larger infrastructure footprint required.
Rich changelog capabilities, including findings over time, and changes over time.
Shows current view with changelog represented only in graphs.
ReARM Pro vs ReARM CE
ReARM Community Edition is a fully functional FOSS version. ReARM Pro adds managed infrastructure, premium support, and advanced features for teams and enterprises.
ReARM Pro
ReARM CE
Managed service with SSO - no infrastructure to maintain. Support for client-hosted deployments, including air-gapped deployments, available for higher tiers.
Self-hosted - you manage your own infrastructure.
Premium support (up to 24x7 depending on plan).
Community support via Discord and GitHub.
Managed Dependency-Track instance included.
Self-managed Dependency-Track integration.
Approval and trigger workflows for release lifecycle.
Core BOM storage functionality and retrieval without approval workflows.
Workflow for marketing releases (separate versioning schema that may be used for marketing).
No marketing release functionality.
Support for perspective, multi-organization workflow support (Standard and Enterprise plans)
Single organization and single perspective only.
On-premise / air-gapped deployment option (Enterprise plan)
Self-hosted by default
ReARM vs GUAC
GUAC (Graph for Understanding Artifact Composition) is an open-source project by OpenSSF that aggregates software security metadata into a graph database for querying. While both tools deal with supply chain data, they serve different purposes.
ReARM
GUAC
Release-centric evidence store: artifacts are stored per versioned release with full provenance, audit trail, and lifecycle management.
Graph-based aggregation engine: ingests metadata from multiple sources into a queryable knowledge graph.
Stores raw artifacts (SBOMs, VEX, VDR, SARIF, attestations, signatures) compressed for 10+ years with full traceability.
Ingests and normalizes metadata but does not preserve original raw artifacts.
Product-Component model with multi-level nesting, automated bundling, and configurable auto-integration engine.
Flat graph structure linking artifacts, packages, and vulnerabilities without a product/release hierarchy.
Built-in finding audit engine with scoped auditing (organization, product, component, branch, release levels).
Provides graph queries to explore relationships between artifacts and vulnerabilities but no built-in audit workflow.
Production-ready platform with managed service option (ReARM Pro), UI, approval workflows, and premium support.
Research-oriented project primarily offering a CLI and API. No managed service or built-in UI for end users.
Integrates with Dependency-Track for continuous vulnerability monitoring with proprietary deduplication and changelog tracking.
No continuous monitoring workflow.
Supports OWASP Transparency Exchange API (TEA) and VDR export in CycloneDX and PDF formats.
Focuses on GUAC ontology and CertifyVuln/CertifyGood graph predicates. No TEA or VDR export support.
SBOM enrichment and augmentation via Reliza's BEAR integration, storing enriched SBOMs alongside originals.
Integrates with multiple data sources (deps.dev, OSV, SLSA) for graph enrichment. Enriches graph data by correlating multiple sources but does not produce enriched SBOMs.
ReARM vs Traditional SCA Tools
Traditional Software Composition Analysis (SCA) tools like Semgrep, Snyk, Black Duck (Synopsys), Checkmarx, Mend (WhiteSource), and Sonatype focus on scanning and finding vulnerabilities. ReARM is not an SCA tool - it is a Release-Level Supply Chain Evidence Platform that integrates with SCA tools.
ReARM
SCA Tools (Semgrep, Snyk, Black Duck, Checkmarx, Mend, Sonatype)
Stores and versions all supply chain artifacts (SBOMs, SARIF, VEX, VDR, attestations) produced by any tool in a release-centric model.
Generate point-in-time scan results and vulnerability reports.
Tool-agnostic - ingests outputs from any SCA, SAST, or DAST tool.
Typically, locked to their own scanning engine and data format.
Release-centric model: artifacts are tied to specific versioned releases with detailed provenance within the release (release as a whole, source code entry, deliverable).
Project or repository-centric scanning, often without release-level tracking.
Long-term artifact retention (10+ years) and continuous monitoring for vulnerabilities, including for old releases, for compliance and audit.
Focus on point-in-time scanning results.
Aggregates findings from multiple tools into a unified view with changelogs.
Each tool usually provides its own siloed view of vulnerabilities.
Provides search capabilities across entire supply chain evidence base, such as identifying instances of specific dependency or vulnerability.
Usually, limited to point-in-time scan results.
Own finding audit engine with various scopes (organization-wide, product-level, feature set-level, component-level, branch-level, release-level). Supports all findings from various sources.
Usually, limited to their own finding with no understanding of scopes.
Product-level aggregation with multi-level component nesting.
Typically, analyze individual repositories or container images.