Freedom251 › Dependency Management Software
FossID Workbench
What FossID Workbench is
FossID Workbench is software composition analysis software for finding and governing third-party components in codebases. It examines direct and transitive dependencies in supported package manifests, scans unmanaged source code across programming languages, and detects open-source snippets embedded in files, including modified code and snippets as small as six lines. ID Assist proposes component identities, while License Extractor finds and extracts license text at file level. For vulnerability review, Vulnerable Snippet Finder locates code blocks associated with CVEs, and VEX data provides exploitability context.
Workbench can create, import, consolidate, and export software bills of materials with component, license, vulnerability, and usage details. SBOMs can be exported in SPDX or CycloneDX formats. Policy Management applies license, security, and software usage rules across projects. Teams can import and scan code from GitHub, GitLab, and Bitbucket, and use CI/CD workflows to scan, gate, and notify on pull requests. An API supports custom scanning, gating, and notification workflows.
FossID offers cloud, hybrid, and on-premises deployment, including an offline air-gapped option. The company says fingerprint-based scanning lets teams review findings without source code leaving their infrastructure. Workbench is a paid product with pricing on request. FossID was founded in 2016 and is headquartered in Stockholm, Sweden.
Who it suits
Workbench suits engineering, DevSecOps, security, compliance, legal, and audit teams that need visibility into third-party code, licenses, and vulnerabilities. It is also relevant to enterprise software teams that need SBOMs, policy controls, or scanning integrated into development workflows.
What it does well
- Finds open-source snippets, including modified code and snippets as small as six lines.
- Creates and exports SBOMs in SPDX or CycloneDX formats.
- Applies license, security, and usage policies across projects.
- Supports scanning and pull-request workflows with GitHub, GitLab, and Bitbucket.
- Offers cloud, hybrid, on-premises, and air-gapped deployment options.
What to know first
- Pricing is available on request.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| FossID Workbench | Pricing not stated; contact FossID for a quote | On request |
As fossid.com lists them, read 10 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the FossID website.
- Contact FossID for pricing on request.
- Choose a cloud, hybrid, or on-premises deployment, including an offline air-gapped option.
- Import code from GitHub, GitLab, or Bitbucket, or use the API for custom workflows.
- Configure scanning, policy enforcement, or CI/CD scan and gate workflows.
Verdict
Choose FossID Workbench if your team needs to identify third-party components, manage software policies, and produce SBOMs across codebases. Its range of deployment options and workflow integrations may suit enterprise teams; buyers who need a stated price should look elsewhere or request a quote.
Questions
How much does FossID Workbench cost?
FossID Workbench is paid, with pricing on request.
Which platforms does Workbench support?
It is available via API, Linux, self-hosted deployment, and the web.
Can Workbench generate SBOMs?
Yes. It can create, import, consolidate, and export SBOMs in SPDX or CycloneDX formats.
Which code hosting services can it scan?
Workbench can import and scan code from GitHub, GitLab, and Bitbucket.
What deployment options does FossID offer?
FossID offers cloud, hybrid, and on-premises deployments, including an offline air-gapped option.
Who makes FossID Workbench?
FossID makes Workbench. The company was founded in 2016 and is headquartered in Stockholm, Sweden.
Facts from FossID Workbench's own pages
- Access management
- Workbench 26.2 added SAML single sign-on, working with user groups and SCIM synchronization. · fossid.com, 10 Oct 2026
- API
- The Workbench API supports custom workflows for scanning, gating, and notifying. · fossid.com, 9 Oct 2026
- Audience
- FossID describes its customers as enterprise software teams and says its users span engineering, legal, compliance, and security roles. · fossid.com, 10 Oct 2026
- Code detection
- Its scanning identifies open-source code snippets, including snippets as small as six lines, and is designed to detect code despite modifications. · fossid.com, 10 Oct 2026
- Company
- FossID says it was founded in 2016 and was reacquired by its founders in 2022 after being acquired by Snyk in 2021. · fossid.com, 9 Oct 2026
- Dependency analysis
- Workbench identifies direct and transitive dependencies from supported package manifests, while source scanning can find unmanaged code. · fossid.com, 10 Oct 2026
- Deployment
- FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option. · fossid.com, 10 Oct 2026
- Detection
- It analyzes dependencies, scans unmanaged source code regardless of programming language, and detects open-source snippets embedded in source files. · fossid.com, 9 Oct 2026
- Founded
- 2016 · fossid.com, 28 Sept 2026
- Headquarters
- Stockholm, Sweden · fossid.com, 28 Sept 2026
- Identification
- ID Assist proposes component identifications, and License Extractor detects and extracts file-level license text. · fossid.com, 9 Oct 2026
- Integrations
- Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications. · fossid.com, 10 Oct 2026
- Intended users
- FossID describes its tools for engineering, DevSecOps, compliance, legal, and audit teams, and says it is trusted by enterprise software teams. · fossid.com, 9 Oct 2026
- M&A audits
- FossID describes a blind audit process that creates a one-way hash and does not require access to the target’s source code. · fossid.com, 9 Oct 2026
- Policy controls
- Policy management can enforce license, security, and software usage rules across projects. · fossid.com, 10 Oct 2026
- Policy management
- Policy Management can automatically enforce license, security, and usage policies across projects. · fossid.com, 9 Oct 2026
- Product
- FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. · fossid.com, 9 Oct 2026
- Purpose
- FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. · fossid.com, 10 Oct 2026
- SBOM
- Workbench can create SBOMs with component, license, vulnerability, and usage information and export them in SPDX or CycloneDX formats. · fossid.com, 9 Oct 2026
- SBOMs
- Workbench supports creating, importing, consolidating, and exporting SBOMs in SPDX and CycloneDX formats. · fossid.com, 10 Oct 2026
- Security certifications
- FossID announced ISO/IEC 27001 information security management and ISO 9001 quality management certifications in 2024. · fossid.com, 10 Oct 2026
- Source confidentiality
- FossID says its fingerprint-based scanning sends hash values rather than source code, which remains in the client environment. · fossid.com, 10 Oct 2026
- Support
- FossID directs customers to its support portal for help and ticket submission. · fossid.com, 10 Oct 2026
- Vulnerability review
- Workbench provides vulnerability triage and VEX authoring, with CVE details including CVSS data, EPSS scores, and CISA KEV indicators in version 26.2. · fossid.com, 10 Oct 2026
Where FossID Workbench stands on Freedom251
- Dependency Management Software#17 of 27
- Software Composition Analysis Software#49 of 65
- Open Source License Compliance Software#26 of 28