Ortelius

Ortelius is a deployment-aware SBOM and vulnerability platform for teams that need to connect component versions with the systems actually running them. It suits security and platform teams operating CI/CD environments, especially when endpoint-level impact matters more than a static dependency list. The main trade-off is that repository onboarding still requires a separate SBOM step.

Overview

Ortelius combines software bills of materials with Helm, release and deployment metadata to map open-source packages and versions to deployed endpoints. Its digital-twin approach keeps inventory tied to live deployment context, so a vulnerable package can be related to the artifacts, deployments and systems where it is present.

This is a practical distinction for organizations managing many environments: the question is not only whether a dependency is affected, but which running systems require attention. Ortelius also provides license analysis, SBOM exchange and release monitoring alongside vulnerability analysis.

Key features

Ortelius consumes SPDX and CycloneDX SBOMs and can create an SBOM with Syft when one is unavailable. Its GitHub App helps connect installations and onboard repositories, importing release and deployment metadata. That integration does not attach an SBOM by itself, so teams must generate or provide one as a separate onboarding activity.

Vulnerability checks use OSV.dev public APIs every ten minutes. Ortelius remaps that intelligence against deployed SBOMs on the same interval, with the stated goal of mapping newly disclosed issues to software inventory within ten minutes of reporting. A trace can run from an affected package and version through its artifact and deployment to an endpoint, which is more actionable than a package-only alert.

The post-deployment security compliance dashboard links project security signals, versioned SBOMs, live deployments and vulnerability detection. It describes continuous alignment with NIST 800-218 SSDF and correlates OpenSSF Scorecard results with packages and versions deployed across environments. The CLI captures supply-chain data at build and deployment stages in CI/CD pipelines.

Ortelius supports REST and GraphQL APIs protected by JWT middleware. Community questions are handled through Discord and GitHub issues. The hosted deployment identified by the project is at app.deployhub.com and requires no infrastructure setup.

Pricing

The free plan is a useful way to evaluate deployment mapping or run a very small inventory, but its five-component ceiling makes it unsuitable for a broad production estate. Unlimited users and endpoint tracking prevent seat or tracking counts from being the immediate constraint. Enterprise shifts the cost to component coverage, so spending follows inventory growth rather than a fixed user count. It is the appropriate tier for organizations needing more than five components, team-level permissions, directory integration or commercial assistance. The free offering has user-level access controls; DeployHub adds group-level controls and LDAP/Active Directory support.

Platforms

Ortelius is offered through an API, a web interface and self-hosted deployment. Ortelius OS can run as SaaS or on-premise/self-hosted software, while DeployHub Enterprise also supports SaaS or self-hosting. That range suits teams that want the hosted app without infrastructure work as well as organizations that must operate the service themselves.

Who it's for

Choose Ortelius when security, release and platform teams need to locate vulnerable components across deployed endpoints, not merely catalogue build dependencies. It is particularly relevant to CI/CD organizations that can feed SBOM and deployment data through the CLI or APIs and want frequent OSV.dev re-evaluation.

It is a weaker fit for a small project whose inventory will quickly exceed five components but cannot justify per-component Enterprise pricing, or for teams expecting a GitHub connection to supply complete SBOM coverage automatically.

Pros and cons

Pros

• Deployment-level impact tracing: package findings can be followed through artifacts and deployments to affected endpoints.
• Frequent vulnerability refresh: OSV.dev checks and inventory remapping run every ten minutes.
• Flexible operation: SaaS, on-premise and self-hosted options are supported, with REST and GraphQL APIs.
• Generous free access for small estates: unlimited users and endpoint tracking are included at no cost.

Cons

• Five-component free cap: larger inventories must move to a $40-per-component-per-month Enterprise model.
• GitHub onboarding is incomplete on its own: release and deployment metadata arrive without an attached SBOM.
• Support differs by tier: free users receive community support, while commercial technical support is reserved for Enterprise.
• Advanced controls are paid: group permissions and LDAP/Active Directory support require DeployHub Enterprise.

Alternatives

For a broader directory of options, see SBOM Management Software.

Sonatype Nexus Repository is the better choice when repository management, full ecosystem support and CI/CD integration are the priority; its Community Edition is free and supports an external PostgreSQL database.

Interlynk suits teams seeking a forever-free community tier without per-seat or per-SBOM metering.

sbomify fits a single-user setup needing one product, five components and unlimited SBOMs and compliance documents, with public documents only.

CAST SBOM Manager is an alternative with a free download and no usage limits stated.

Exodos Labs is worth considering for an inventory-focused community tier with one user, one API key, unlimited inventories and community support.

FOSSA is better for teams that want a free plan capped by projects, contributing developers, release groups and dependency-scan depth.

OTNOS SBOM 360 targets teams wanting monitored assets, CSV imports and daily monitoring in its free tier.

ReARM is an option for self-hosted SBOM/XBOM storage and retrieval with a single organization and community support.

Verdict

Ortelius is a strong choice for teams that need to connect SBOM findings to live deployments and endpoints, with ten-minute vulnerability intelligence refreshes and flexible hosting. Choose it when deployment context is the deciding factor; look elsewhere if five components is too restrictive or if you need GitHub onboarding to provide SBOMs automatically.