Integrate FOSSA with Vulnetix. Use the FOSSA CLI to analyse dependencies, then export CycloneDX or SPDX SBOMs from the FOSSA dashboard for upload to Vulnetix.
Run FOSSA in CI
Scan on every push and upload the report as a workflow artifact:
- name: Install FOSSA CLI
run: |
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash
- name: Run FOSSA analysis
run: fossa analyze
env:
FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
- name: Check for licence violations
run: fossa test
env:
FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
How Vulnetix compares: better together
Vulnetix does not replace FOSSA. Keep running it. Vulnetix sits on top of FOSSA (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
FOSSA is strongest at its core category and also carries features in License Compliance, SBOM Generation, Container & Image Scanning, just as Vulnetix spans categories.
| Capability | Vulnetix | FOSSA |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Core SCA over npm, pip, Maven, Gradle, Go, Cargo, Ruby and more with cloud policy evaluation |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ~ License and vulnerability scanning for container packages across major base images |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✓ Full-text license analysis detecting modified, dual-licensed and non-standard terms |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✓ Generates SPDX and CycloneDX SBOMs with lifecycle management and customization |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✓ EPSS scoring layered on multi-source vuln data (NVD, GHSA, OSV, proprietary) |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ~ Reachability analysis traces whether code calls the vulnerable function (build-level GA; function-level beta for Maven) |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ~ Supports vulnerability triage/attestations feeding SBOM workflows |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What FOSSA does well
- Best-in-class open-source license compliance with full-text analysis (cited very high, ~99%, detection accuracy) that catches modified, dual and non-standard licenses
- Complete SBOM lifecycle management with heavily customizable CycloneDX and SPDX exports
- Vulnerability data aggregated from NVD, GitHub Security Advisories, OSV and a proprietary DB, with EPSS scoring and reachability analysis
- Broad container package/license scanning across Debian, Ubuntu, CentOS, Oracle Linux, Fedora, Alpine and Wolfi base images
Where Vulnetix adds to it: Vulnetix ingests FOSSA's SBOMs, license findings and SCA results and dedups them with SAST/secrets/IaC/container/cloud scanners into one prioritised queue, adding CISA KEV + Coalition ESS + CWSS + Vulnetix LEV on top of FOSSA's EPSS, immutable versioned VEX with audit, Safe Harbour autofix PRs, EOL and SSVC. Better together: FOSSA stays the license-compliance and SBOM authority while Vulnetix is the security-prioritisation and orchestration layer.
No migration, no rip-and-replace. FOSSA keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise FOSSA results in Vulnetix
Upload FOSSA CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.