OTNOS SBOM 360 helps operational technology manufacturers ingest, assess, monitor and report software products in response to the Cyber Resilience Act. It accepts CycloneDX and SPDX SBOMs and produces CycloneDX VEX, OpenVEX and SBOMs with embedded VEX. A read-only GitHub app maps repositories to products and updates SBOMs after default-branch pushes and nightly checks. Its vulnerability intelligence mirrors more than 400,000 advisories, syncs daily and is queried locally without sending component names outside the tenant. Findings show EPSS alongside severity, installed and fixed versions, CISA KEV status and EUVD identifiers. Teams can mark findings affected, not affected, fixed or under investigation, with justifications, workarounds and decision history. The platform drafts all 39 ENISA Single Reporting Platform fields for 24-hour, 72-hour and final Article 14 reports. Configurable alerts cover new affecting advisories, available fixes, KEV listings and rising EPSS scores. The cloud service places application and database data in Germany, with files and backups in EU regions. Free is listed at 0.00 USD per free; Professional and Enterprise pricing is custom.
Who it is for
OTNOS SBOM 360 is intended for OT security engineers, PSIRT and vulnerability-management teams, consultants and MSSPs in energy, manufacturing, water and building technology. It is relevant to teams handling SBOMs and Cyber Resilience Act reporting.
What is good
- Accepts CycloneDX and SPDX SBOMs.
- Mirrors over 400,000 advisories with daily sync.
- Component names are queried locally.
- Drafts all 39 Article 14 reporting fields.
- Files and backups stay in EU regions.
What to know first
- Free plan allows one user.
- Free plan limits monitoring to 50 assets.
- Free plan allows two CSV imports monthly.
- Professional and Enterprise pricing is custom.
Verdict
OTNOS SBOM 360 combines SBOM handling, vulnerability triage, monitoring and Article 14 report drafting for OT manufacturers. Its free plan has user, asset and import limits; higher-tier prices are custom.
OTNOS SBOM 360 plans and pricing
All plansCompared on SBOM management software
- Free plan
- Yes
- SBOM standard support
- both
- Deployment model
- cloud
- Vulnerability analysis
- Yes
- Policy enforcement
- Yes
- SBOM exchange
- Yes
- Release monitoring
- Yes
