About
NetRise offers the NetRise Platform for software supply chain security by analyzing compiled code rather than source code. The platform provides visibility into compiled software that runs in devices, apps, operating systems, and critical infrastructure, identifying components in a software build and validating the Software Bill of Materials (SBOM) with a binary-derived inventory of code that actually executes. NetRise emphasizes prioritization — "See Beyond CVEs" and "Prioritize What's Reachable" — to drive remediation and mitigation. The product also supports supplier risk assessment and comparing products for procurement, and enables inspection of third-party code without relying on vendor self-attestations or delayed disclosures.
Related Vendors
Chainloop is presented as a platform for SDLC governance that centralizes and verifies software supply-chain artifacts. The record states Chainloop unifies security artifacts (SBOMs, signatures, and attestations) into a single, verifiable source of truth and describes a "secure, scalable platform for managing Software Bills of Materials." The product is positioned for platform & DevSecOps (implement control gates, automate risk assessments across the software delivery lifecycle) and for compliance & legal (automate compliance checks, streamline audits, and centralize license compliance management). Messaging highlights alignment of teams across the SDLC and automated decision-making.
Wind River provides software and platform solutions for mission-critical embedded and edge systems. The record describes a Yocto Project embedded Linux subscription that includes security vulnerability monitoring, long-term maintenance and support, and materials around the software bill of materials (SBOM). Wind River also offers Studio tools to create, build and integrate software for embedded and edge systems, an embedded virtualization platform to run multiple OSes on a single SoC, and a Debian-based enterprise Linux distribution for edge computing. The company describes tooling to automate testing, deploy, orchestrate and update software for embedded devices and to analyze data across networks of distributed devices and servers.
Sonatype provides solutions for managing and securing open source and third-party components throughout the software development lifecycle (SDLC). Their platform, including Nexus Repository and IQ Server, integrates with various DevSecOps tools and development environments to ensure policy compliance. Features include automated alerts for policy violations, integration with popular CI/CD platforms, and real-time risk intelligence. Sonatype effectively empowers developers by embedding security practices directly into their workflows, enhancing efficiency and compliance management.