--- title: Dependency-Check Comparison sitemap: true ---

Identifying risk in supply chains containing third-party and open source components involves identifying known vulnerabilities, component age and "freshness", license terms, project health, chain of custody, and a host of other factors. Component analysis is applicable to software being developed, purchased, or as a result of being embedded in a device (or the device itself). If a vulnerability is possible for a given component (software or hardware) it can and should be analyzed.

One of the most common questions that arise from people familiar with either Dependency-Check or Dependency-Track is the distinction between the two. What's the relationship between them and how they are different?

| Dependency-Track | Dependency-Check
--- | --- | ---
Software type | Platform | Library with multiple implementations: Command line interface Build plugins (Maven, Ant, etc) Jenkins plugin
Approach | Software Bill-of-Materials (SBOM) which can be automatically generated at build-time or obtained from vendors | Scans files on filesystem and extracts evidence with varying degrees of confidence
Vulnerability intelligence | Precise matching via NVD Sonatype OSS Index GitHub Advisories VulnDB | Fuzzy matching via NVD Sonatype OSS Index NPM Audit API Retire.js
Outdated version identification | Cargo (Rust) Composer (PHP) Hex (Erlang/Elixir) RubyGems (Ruby) Maven (Java) NPM (JavaScript) NuGet (.NET) PyPI (Python) | None
Ecosystems supported | Ecosystem agnostic (all ecosystems supported) | 10+ with varying degrees of maturity
Reporting | Dynamic intelligence and metrics delivered via REST API or web interface | Per-project statically generated HTML, XML, JSON, and CSV reports
License support | Resolves over 500 SPDX license IDs as well as supporting unresolved license names | Unresolved license names as evidence
Jenkins plugin | Yes (bidirectional) | Yes (unidirectional)
Sonarqube plugin | No | Yes
Vulnerability aggregation | CodeDx (vendor supported) Defect Dojo (vendor supported) Kenna Security (natively supported) Fortify SSC (natively supported) Security Compass (vendor supported) ThreadFix (vendor supported) | CodeDx (vendor supported) Defect Dojo (vendor supported) Nucleus Security (vendor supported) Orchestron (vendor supported) Security Compass (vendor supported) ThreadFix (vendor supported) ZeroNorth (vendor supported)
Notification support | Slack Microsoft Teams Mattermost Cisco WebEx Webhooks Email Jira | None
Auditing | Per-project and global auditing workflow supporting analysis decisions, comments, and suppressions that are captured and tracked in a per-finding audit log | Suppression file with support for CPE, filename, and regex pattern matching
Private vulnerability repository | Yes | No
Perspectives | Portfolio of projects (applications, services, devices, etc) Project Dependency Component Vulnerability License | Project Dependency Vulnerability