Freedom251 › SBOM Management Software
OTNOS SBOM 360
What OTNOS SBOM 360 is
OTNOS SBOM 360 helps operational technology manufacturers ingest, assess, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and produces CycloneDX VEX, OpenVEX and SBOMs with embedded VEX. A read-only GitHub app maps repositories to products and updates SBOMs after default-branch pushes and nightly checks. Its vulnerability intelligence mirrors more than 400,000 advisories, syncs daily and is queried locally without sending component names outside the tenant. Findings show EPSS alongside severity, installed and fixed versions, CISA KEV status and EUVD identifiers. Teams can mark findings affected, not affected, fixed or under investigation, with justifications, workarounds and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for 24-hour, 72-hour and final Article 14 reports. Configurable alerts cover new affecting advisories, available fixes, KEV listings and rising EPSS scores. The cloud service places application and database data in Germany, with files and backups in EU regions. Free is listed as free; Professional and Enterprise pricing is custom.
Who it suits
OTNOS SBOM 360 is intended for OT security engineers, PSIRT and vulnerability-management teams, consultants and MSSPs in energy, manufacturing, water and building technology. It is relevant to teams handling SBOMs and Cyber Resilience Act reporting.
What it does well
- Accepts CycloneDX and SPDX SBOMs.
- Mirrors over 400,000 advisories with daily sync.
- Component names are queried locally.
- Drafts all 39 Article 14 reporting fields.
- Files and backups stay in EU regions.
What to know first
- Free plan allows one user.
- Free plan limits monitoring to 50 assets.
- Free plan allows two CSV imports monthly.
- Professional and Enterprise pricing is custom.
Limits
The Free plan covers 50 monitored assets and one user, with two CSV imports per month, one saved CSV, and a 1 MB CSV maximum. It includes daily monitoring, basic AI risk analysis, and community support.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | $0/forever · 50 monitored assets · 1 user · 2 CSV imports/month · 1 saved CSV · max CSV 1 MB · daily monitoring · basic AI risk analysis · community support | Free |
| Professional | Custom · 1,000 monitored assets · up to 50 users · 50 CSV imports/month · 25 saved CSVs · max CSV 10 MB · 10K API calls/month · hourly monitoring · 50 PCAP analyses/month · priority support | On request |
| Enterprise | Custom · Custom assets and users · 100K API calls/month included · real-time monitoring · custom PCAP limits · dedicated support + SLA · advanced RBAC | On request |
As otnos.com lists them, read 1 Oct 2026. The maker's own page has the final word.
Getting started
- Open the OTNOS SBOM 360 website.
- Choose the Free plan or contact OTNOS about a custom-priced plan.
- Use the web platform or API.
- Import CycloneDX or SPDX SBOMs, or connect the read-only GitHub app.
Verdict
OTNOS SBOM 360 combines SBOM handling, vulnerability triage, monitoring and Article 14 report drafting for OT manufacturers. Its free plan has user, asset and import limits; higher-tier prices are custom.
Questions
Is there a free plan?
Yes. The Free plan is listed as free, billed at $0 forever.
What does the Free plan include?
It includes 50 monitored assets, one user, two CSV imports per month, one saved CSV, a 1 MB CSV maximum, daily monitoring, basic AI risk analysis, and community support.
Which SBOM formats does it support?
It consumes CycloneDX and SPDX SBOMs and produces CycloneDX VEX, OpenVEX, and SBOMs with embedded VEX.
Which platforms are available?
The listed platforms are web and API.
What do the paid plans cost?
Professional and Enterprise are both listed as custom-priced.
Where is data hosted?
Application and database data run in Germany, while files and backups stay in EU regions. Data is encrypted in transit and at rest.
Facts from OTNOS SBOM 360's own pages
- Audience
- OTNOS says it works with OT security engineers, PSIRT and vulnerability-management teams, consultants and MSSPs across energy, manufacturing, water and building technology. · otnos.com, 1 Oct 2026
- Compliance posture
- OTNOS is CSA STAR Level 1 listed, GDPR-aligned with a DPA available, and operates an ISO/IEC 27001:2022 ISMS while formal certification is planned. · otnos.com, 1 Oct 2026
- CRA reporting
- OTNOS drafts all 39 ENISA Single Reporting Platform fields for 24-hour, 72-hour and final Article 14 reports. · otnos.com, 1 Oct 2026
- GitHub connector
- A read-only GitHub app maps repositories to products and updates SBOMs on default-branch pushes and nightly checks. · otnos.com, 1 Oct 2026
- Integrations
- Listed integrations and data sources include GitHub, OSV, GitHub Advisories, CISA KEV, FIRST EPSS, ENISA EUVD, endoflife.date, Microsoft Power Automate, webhooks, REST API and MCP for AI agents. · otnos.com, 1 Oct 2026
- Monitoring alerts
- Configurable triggers cover new affecting advisories, newly available fixes, KEV listings and rising EPSS scores, with deduplicated email digests. · otnos.com, 1 Oct 2026
- Purpose
- SBOM 360 ingests, analyzes, assesses, monitors and reports software products for OT manufacturers responding to the Cyber Resilience Act. · otnos.com, 1 Oct 2026
- Risk analysis
- Findings show EPSS beside severity, installed versions beside fixed versions, CISA KEV status and EUVD identifiers. · otnos.com, 1 Oct 2026
- SBOM formats
- The platform consumes CycloneDX and SPDX SBOMs and produces CycloneDX VEX, OpenVEX and SBOMs with embedded VEX. · otnos.com, 1 Oct 2026
- Security hosting
- Application and database data run in Germany, files and backups stay in EU regions, and data is encrypted in transit and at rest. · otnos.com, 1 Oct 2026
- VEX workflow
- Users can mark findings affected, not affected, fixed or under investigation with justifications, workarounds and decision history. · otnos.com, 1 Oct 2026
- Vulnerability intelligence
- OTNOS mirrors more than 400,000 advisories across ecosystems, synced daily and queried locally without sending component names outside the tenant. · otnos.com, 1 Oct 2026
Where OTNOS SBOM 360 stands on Freedom251
- SBOM Management Software#9 of 22