Overview

OWASP Dependency-Track is an intelligent, continuous Software Composition Analysis (SCA) and component analysis platform. Instead of running point-in-time scans, it ingests CycloneDX Software Bill of Materials (SBOM) documents and continuously monitors every component, in every version of every application across an organization's entire portfolio, to identify and reduce risk in the software supply chain.

It is an OWASP Flagship project with an API-first design, making it well suited to CI/CD automation. The system ships as two main parts, an API server and a frontend, and is typically deployed via Docker, Kubernetes, or an executable WAR.

Dependency-Track monitors component usage across all versions of every application in its portfolio in order to proactively identify risk across an organization.

Core capabilities

  • Portfolio-wide component inventory across applications, libraries, frameworks, containers, operating systems, firmware, hardware, and services
  • Vulnerability identification correlating components against multiple intelligence feeds
  • Configurable policy engine enforcing security, license, and operational risk policies
  • License risk and compliance analysis with NIST and CISA alignment
  • Detection of outdated, modified, and end-of-life components
  • VEX (Vulnerability Exploitability Exchange) support and an audit / triage workflow
  • Risk scoring and time-series metrics, including EPSS-based prioritization
  • Broad integration ecosystem for CI/CD, ticketing, chat, and AppSec tooling

Data sources & integrations

Dependency-Track enriches SBOM analysis by correlating components against several vulnerability intelligence datasources, blending the results to improve coverage and accuracy.

  • National Vulnerability Database (NVD)
  • OSV (Open Source Vulnerabilities, Google)
  • GitHub Advisories
  • Sonatype OSS Index
  • Trivy
  • Snyk
  • VulnDB (Risk Based Security)
  • EPSS (Exploit Prediction Scoring System) for exploitability-based prioritization
  • CI/CD: Jenkins plugin, GitHub Actions, and other pipeline tooling via REST API
  • Issue tracking & notifications: Jira, Slack, Microsoft Teams, Mattermost, email, and webhooks
  • AppSec aggregation: DefectDojo, ThreadFix, Fortify SSC, and Kenna Security
  • Authentication: OAuth 2.0 / OIDC SSO, Active Directory / LDAP, internal users, and API keys

How it is used

A typical workflow pairs SBOM generation with analysis: a CI/CD pipeline produces a CycloneDX SBOM during the build and uploads it to Dependency-Track via the REST API, the Jenkins plugin, or the web UI. From there the platform continuously re-evaluates that inventory as new vulnerability intelligence arrives.

  • Embed SBOM upload as a step in CI/CD builds for every release
  • Continuously monitor the whole portfolio, so newly disclosed CVEs surface against already-shipped software without re-scanning
  • Configure alerting (Slack, Teams, Jira, webhooks) to notify teams when new risk appears
  • Apply the policy engine and audit workflow to triage findings, record VEX justifications, and enforce gates

History

Dependency-Track originated in 2013 as a v1 desktop application. It was completely re-architected as a server platform in v3 (2018), then evolved into the modern API-first v4 platform. Development continues through the 4.x line, with the latest stable release being v4.14.2 (May 2026) and a major v5.0.0 currently in release-candidate stage.

Resources