Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

OWASP DevGuard review

Freemium#29 of 32 in Vulnerability Management Software

A broad developer-security toolkit for teams managing software supply-chain risk.

6.3/10Editor score
Visit DevGuard
OWASP DevGuard6.3 Visit DevGuard

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

DevGuard is an open-source vulnerability management and developer security platform from L3montree GmbH. It is aimed at development, DevOps, and security teams that need to centralize findings across dependencies, source code, infrastructure-as-code, container images, and deployed artifacts. Its coverage also includes secret scanning, SBOM and VEX management, risk-based prioritization, dependency firewall capabilities, and vulnerability lifecycle tracking. That breadth makes it a fit for securing software supply chains, rather than a general infrastructure vulnerability management platform.

Its deployment options and integrations are central to its fit. The Open Source plan is self-hosted and includes all features, with community support; it is free for public projects with an OSI-approved license. Business SaaS includes managed hosting in Germany, 10 user seats, and four hours of monthly support, with a one-year contract paid yearly. Enterprise supports deployment in a customer data center or cloud, unlimited users, projects, and assets, plus custom SLA and support options. DevGuard has a web interface and API, supports Windows, macOS, and Linux, and integrates with GitHub Issues, GitLab Issues, and Jira. Trivy, Grype, and Semgrep are also listed integrations.

The package is strongest when teams want scanning and remediation status in one workflow: OPA/Rego policy enforcement and a dependency firewall extend coverage from finding issues to governing package use. The Open Source plan gives eligible public projects access to all features without a plan fee, while paid options add managed hosting or enterprise deployment and support terms. Teams looking for broad infrastructure asset discovery should consider a different category fit; DevGuard is better suited to development-led programs focused on code, dependencies, and build artifacts. The managed option suits teams preferring hosted operations, while self-hosting is available for teams that want to run the platform themselves.

OWASP DevGuard pros and cons

  • Where it wins
    • Scans dependencies, code, secrets, IaC, and container images
    • Combines SBOM/VEX workflows with risk-based prioritization
    • Offers self-hosting and integrations with GitHub, GitLab, and Jira
  • Where it doesn't
    • Focuses on software supply chains, not general infrastructure VM
    • Business SaaS requires a one-year contract paid yearly
    • Enterprise deployment and support require a custom quote

OWASP DevGuard fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update