CRA Evidence Desk vs. OWASP Dependency-Track
Two different shapes: Dependency-Track is a continuous, self-hosted SBOM-analysis server you run and maintain. This is a free, one-shot page or CLI for a single question — do this SBOM and this advisory export name any of the same components right now, and can I get a reviewable Article 14 draft out of that in minutes.
What each tool is for
OWASP Dependency-Track is a free, open-source platform that organizations deploy as a running service (Docker containers plus a database) to ingest SBOMs continuously and watch every tracked component — libraries, containers, operating systems, firmware, services — against multiple vulnerability-intelligence sources (the NVD, Sonatype OSS Index, GitHub Advisories, OSV, and others) for as long as it keeps running, so a CVE disclosed after your last build still fires an alert. It has a policy engine, EPSS-based prioritisation, and portfolio-wide project tracking. Running it is an ongoing operational commitment: someone has to deploy it, secure the database and API, patch it, and keep it fed.
CRA Evidence Desk does none of that. It has no server, no database, and no memory between visits — it is a static page (or a CLI you run by hand or in CI) that reads one SBOM and one advisory export you already have and makes only exact name/ecosystem/version matches, names the advisories it could not evaluate, and exports a dated JSON record plus a customer-reviewed Article 14 notification draft. It does not watch anything over time, does not carry its own vulnerability database, and needs nothing installed or kept running.
| Question | Where to answer it |
|---|---|
| I want continuous monitoring across every project I ship, watching new advisories as they are published, with a policy engine and prioritisation. | Dependency-Track — that ongoing, portfolio-wide watch is what it is built for. |
| I have one SBOM and one advisory export in hand right now and need to know which named components actually match, plus a draft I can hand a reviewer today. | CRA Evidence Desk — free, instant, private, nothing to deploy. |
| I don't want to stand up, secure, and patch a server just to answer one reporting question. | CRA Evidence Desk — it is a static page or a single CLI invocation, not a service. |
| I need a document shaped for a specific obligation — a CRA Article 14 notification draft — not a general vulnerability dashboard. | CRA Evidence Desk's draft output is built around that one document. |
| I want my own private vulnerability-intelligence database, aggregated from multiple public feeds, kept current automatically. | Dependency-Track — it maintains that database for you as a running service. |
| Does the tool upload my SBOM anywhere? | CRA Evidence Desk: no, it never leaves your device. Dependency-Track: it is designed to receive SBOMs, since ingesting and storing them is its job. |
Most vendors get different value from each: Dependency-Track (or a comparable SCA platform) for an always-on watch across a whole portfolio, and a tool like this one for an instant, no-deployment check of one SBOM against one advisory export before a specific filing question. This page's own output is a single evidence artifact from the inputs you gave it, not a vulnerability database, a continuous scan, or a substitute for reviewing the advisories yourself.
This tool needs no install and no server: it is a static page, the matching runs in your browser (or as a single CLI command), and once loaded it keeps working with the connection off.
Common questions
Should I use CRA Evidence Desk or OWASP Dependency-Track?
They solve different problems. Dependency-Track is a continuous SBOM-analysis server: you deploy it (Docker containers, a database, ongoing patching and access control), feed it SBOMs over time, and it watches every component against multiple vulnerability-intelligence sources for as long as it keeps running, with a policy engine and EPSS-based prioritisation across your whole portfolio of projects. CRA Evidence Desk does none of that. It is a static page or a CLI, not a server: give it one CycloneDX/SPDX SBOM and one advisory export (OSV or a plain list) and it makes only exact name, ecosystem and version matches, names what it could not evaluate, and produces a dated JSON record plus an Article 14 draft. Nothing is installed, nothing runs between visits, and nothing is uploaded. A vendor already running Dependency-Track gets continuous monitoring from the platform it operates; a vendor who needs a single, disclosed evidence artifact right now, or who does not want to stand up and secure a server to get one, is in the right place here.
Is this page affiliated with OWASP or Dependency-Track?
No. This page is not affiliated with, endorsed by, or sponsored by the OWASP Foundation or the Dependency-Track project. Dependency-Track is free, open-source software; it is named here only to describe what this tool is and is not.
Open the CRA Evidence Desk to run your own SBOM and advisory export, or see why your SBOM and advisory package names don't match first if the two files use different spellings for the same registry.