OWASP DevGuard

Overview

OWASP DevGuard brings vulnerability management across code, dependencies, infrastructure and deployed artifacts into one platform. It suits developers, DevOps engineers and security teams that want scanning, prioritization and remediation in a shared workflow. Its strongest case is broad coverage with self-hosting available; the main caveat is that free use is restricted to eligible public projects, while private SaaS starts at €449.10 a month on a one-year contract.

Key features

DevGuard’s pipeline covers secret scanning, static application security testing, software composition analysis, infrastructure-as-code and container scanning, as well as license compliance. That span can give teams a common place to manage findings across the software lifecycle. Teams with existing scanners can import CycloneDX SBOM and SARIF data from Trivy, Grype, Semgrep and other standards-compliant tools, so adopting DevGuard need not mean replacing every scanner.

Risk scoring uses CVSS-BE, EPSS and component depth to help teams decide which findings deserve attention first. Remediation tracking and bidirectional synchronization with GitHub Issues, GitLab Issues and Jira connect that work to established issue trackers; slash-command triage adds a way to act from those workflows. This combination is a practical fit for teams that need findings to become assigned work, not just scan reports.

CycloneDX SBOMs, VEX workflows and live SBOM and VEX endpoints support component inventory and vulnerability-status management. The dependency proxy supports npm, Go and PyPI and blocks packages flagged in the OSSF malicious packages database, extending protection to dependency intake.

For organizations with compliance needs, DevGuard describes in-toto attestations, SLSA provenance, cosign signatures and automated evidence for ISO 27001, CRA, BSI IT-Grundschutz and SLSA. Those capabilities make it relevant to teams building traceability into software delivery, though the project’s stated support for evidence does not itself establish compliance.

Pricing

The Open Source plan costs nothing. It includes all features, community support and self-hosting, but only for public projects with an OSI-approved license. That is a generous feature scope for qualifying open-source work; private projects do not fit this plan.

The SaaS plan starts at €449.10 a month, billed yearly under a 1 year contract. It includes 10 user seats, fully managed hosting in Germany, an initial 1-hour setup workshop and 8×5 email support. This is the clearest fit for a team that wants managed operations and can commit to the annual term. The starting price and included seats make it a meaningful commitment for smaller teams.

Enterprise uses an annual subscription with a one-time initial setup and custom pricing. It is self-hosted and includes 20 to 160 support hours per year, with contractual response times of 16 h, 8 h or 4 h. It fits organizations that need self-hosting and contracted support; the SaaS plan instead provides managed hosting and 10 included seats.

A 14-day trial is available. Community support is through the project’s Matrix space and monthly community call.

Platforms

DevGuard is a hybrid platform with a backend API and web UI, and can be self-hosted using Kubernetes or Docker Compose. Its standalone scanner supports Linux, macOS and Windows. This range suits teams that want to run the platform themselves or use its API and web interface, while the SaaS plan offers managed hosting in Germany.

Who it's for

Developers, DevOps engineers and security teams are the intended users. DevGuard says specialized security knowledge is not required, which broadens its appeal beyond dedicated security specialists. It is especially well matched to teams that want a common vulnerability workflow across source, dependencies and infrastructure, or need SBOM, VEX and dependency-proxy capabilities. It is a weaker fit for private projects seeking a free plan or for buyers looking for a low-commitment managed service.

Pros and cons

• Pros: Broad scanning covers secrets, code, dependencies, IaC, containers and license compliance, reducing the need to manage those findings in separate workflows.
• Pros: Risk scoring, remediation tracking and bidirectional issue synchronization tie prioritization to work in GitHub Issues, GitLab Issues or Jira.
• Pros: The public-project plan includes all features, and self-hosting is supported through Kubernetes or Docker Compose.
• Cons: The free plan excludes private projects, limiting its value for teams evaluating DevGuard on proprietary code without moving to a paid option.
• Cons: SaaS starts at €449.10 a month with a 1 year contract and 10 included seats, a substantial commitment for small teams.
• Cons: Enterprise requires a one-time setup and custom-priced annual subscription, so buyers must obtain a quote to assess its cost.

Alternatives

For a broader comparison, browse Vulnerability Management Software.

• Intruder is another freemium option with a free plan and trial; its free tier covers five infrastructure targets, weekly external scans and one connected cloud account, with web apps excluded.
• ManageEngine Vulnerability Manager Plus offers a free edition and a Professional on-premises plan at $695 a year, for readers comparing another freemium option with on-premises pricing.
• Nanitor has a free plan for 10 assets and a Standard plan at $6 a month with unlimited assets, an option for readers focused on asset-based pricing.
• Qualys External Attack Surface Management offers a 30-day trial at no cost for CSAM with EASM, for readers evaluating that trial option.
• OWASP DefectDojo offers a free-forever Community Edition with support through OWASP Slack and GitHub, for readers considering an open-source alternative.
• WPSec has a free plan with monthly scans and up to 10 scan reports, for readers seeking a website-scanning option.
• Tanium Deploy requires a Tanium license that includes Deploy and Tanium Core Platform servers.
• Cyberwatch Vulnerability Manager invites buyers to request a demo.

Verdict

DevGuard is a strong choice for development and security teams that want broad vulnerability coverage, prioritization, remediation tracking and software-supply-chain workflows in a self-hosted or managed platform. Its all-feature open-source plan is compelling for eligible public projects. Private teams should choose it when the integrated workflow and deployment options justify the annual SaaS commitment or a custom-priced enterprise subscription; those seeking free private use or a smaller managed-service commitment should look elsewhere.