Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Kusari review

Freemium#8 of 28 in Dependency Management SoftwareSoftware Supply Chain Security Software

Kusari combines dependency intelligence, compliance controls, and automated remediation.

8.0/10Editor score
Visit Kusari
Kusari8.0 Visit Kusari

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Kusari is a software supply chain security platform for engineering, security, and compliance teams. It builds a continuously updated dependency graph from source, build artifacts, SBOMs, VEX documents, and scanner findings. Teams can use it to examine direct and transitive dependencies, detect and prioritize vulnerabilities, assess reachability, enforce license policies, manage SBOMs, and review pull requests across multiple languages and infrastructure ecosystems.

Pricing is split between a free option and a paid team plan. Solo developers and open source users can use Kusari free for repositories they own, as well as for projects under the OpenSSF or CNCF. Inspector for teams costs $25 USD per developer per month, billed monthly, and adds pull-request security reviews, coverage for every repository the organization owns, and volume pricing. The platform connects with GitHub, GitLab, Jenkins, Azure DevOps, CircleCI, Bitbucket Pipelines, TeamCity, Jira, ServiceNow, Slack, Microsoft Teams, webhooks, Snyk, Black Duck, and Prisma Cloud. API access is also available.

Its strongest distinction is the combination of dependency intelligence and workflow action. Vulnerability prioritization can include reachability analysis, while policy controls cover licenses and merge decisions. Kusari AutoFix generates remediation pull requests, and Kusari Agent supports natural-language queries across the software estate. SBOM and VEX ingestion, storage, monitoring, and generation extend the product beyond alerting. Teams that need centralized visibility, compliance workflows, and pull-request remediation should consider Kusari. It is less suitable for organizations requiring self-hosted deployment or a publicly itemized broader Platform plan.

Kusari pros and cons

  • Where it wins
    • Source-built graphs show direct and transitive dependencies.
    • AutoFix creates automated remediation pull requests.
    • SBOM, VEX, license, and vulnerability controls work together.
  • Where it doesn't
    • No self-hosted deployment option.
    • The free plan applies only to owned or qualifying projects.
    • The broader Kusari Platform is demo-led rather than publicly priced.

Kusari fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update