# How to Monitor Vendor Software Without Repository Access: The Honest Tier Map

> You bought the software, so you cannot scan its source, and the vendor will not hand over the pipeline. What you can get is an SBOM, and what you need is something to do with it. Here is the market's honest tier map: what each class of tool actually costs, what it needs to run, and where it fits a buyer whose tools are 3 to 50 vendor SBOMs with no ops team behind them. Every price below is a published, sourced figure, and our own product is marked plainly where it appears.
- **Published**: 2026-10-26
- **URL**: https://vendorquals.com/blog/vendor-sbom-monitoring-without-repo-access

---

# How to Monitor Vendor Software Without Repository Access: The Honest Tier Map

*You bought the software, so you cannot scan its source, and the vendor will not hand over the pipeline. What you can get is an SBOM, and what you need is something to do with it. Here is the market's honest tier map: what each class of tool actually costs, what it needs to run, and where it fits a buyer whose tools are 3 to 50 vendor SBOMs with no ops team behind them. Every price below is a published, sourced figure, and our own product is marked plainly where it appears.*

## Key takeaways

- **Repository access is the dividing line the tooling market won't say out loud.** Developer-centric SCA tools (Snyk, Black Duck, FOSSA) are built to scan code you control; for software you bought, they either do nothing or charge you enterprise prices for binary analysis. The vendor SBOM is the artifact that exists precisely for the no-access case.
- **The free tier exists but is single-shot or self-hosted.** Free SBOM checkers (Bytesafe, Snyk's, ours) tell you what a file contains today and forget it. The free continuous option, OWASP Dependency-Track, does everything the paid tools do: if you will run a server yourself (its own documentation asks for 2 GB RAM and ops attention forever).
- **The published self-serve prices stop well short of the buyer this article is about.** FOSSA's Business tier is $20 per project per month, built for your own software. UpGuard's self-serve vendor risk plan is $79 per vendor per month. The moment you want vendor SBOM monitoring as a product rather than a project, the published options run out.
- **The enterprise tier is quote-gated by design.** Black Duck's entry runs about $5K/month per practitioner reports; SecurityScorecard listings start around $25K-$35K/year; Venminder's enterprise tier lists at $125K/year; Panorays contracts run $30K-$300K. None of these publish a checkout button, because the product is the sales process.
- **Our own product is one entry in the map and marked as ours:** SBOM Shield at $99/month, up to 50 vendor SBOMs, re-checked daily against OSV. [What it does ->](/sbom-shield)

## The constraint, stated precisely

The buyer this map is for:

- holds software from vendors, not source code from a repository;
- receives (or can request) SBOMs at the procurement checkpoint: [the request language ->](/blog/how-to-request-sbom-from-vendor);
- has a security or risk function, but no operations team standing up a Kubernetes-hosted anything;
- and needs the answer to one recurring question: *is anything in what we bought now vulnerable that wasn't last month?*

Everything below is scored against that buyer.

## The tier map, with published prices

| Tier | Examples | Published price | What it needs from you | Fits the no-repo buyer? |
| --- | --- | --- | --- | --- |
| Free single-shot checkers | Bytesafe analyzer, Snyk's free checker, the VendorQuals checker | $0 | A file, one at a time | Yes, but nothing persists |
| Free continuous, self-hosted | OWASP Dependency-Track | $0 license | A server (2 GB RAM), upgrades, ops attention | Only if you have an ops team |
| Self-serve dev SCA | Snyk, Sonatype, FOSSA | Snyk $25/dev/mo; Sonatype Pro from $1,200/yr; FOSSA $20/project/mo | Repository access to your own code | No: built for first-party software |
| Vendor-risk platforms | UpGuard, SecurityScorecard | UpGuard $79/vendor/mo self-serve; SecurityScorecard $25K-$35K/yr and up | A vendor list, and a sales conversation at the upper tiers | Partial: SBOM depth varies |
| Enterprise SBOM platforms | Black Duck, Anchore, Cybeats, Manifest | Black Duck ~$5K/mo entry (reported); Anchore, Cybeats, Manifest: quote only | An enterprise procurement cycle | The products fit; the buying motion doesn't |
| Vendor SBOM watch, self-serve | VendorQuals SBOM Shield (ours) | $99/mo, up to 50 vendor SBOMs | The SBOM files | Yes: built for exactly this |

Sources: each vendor's own pricing or listing pages as read in our October 2026 sweep; where a vendor publishes no price, the table says so rather than inventing one. What this map cannot tell you: whether any given tool is good at its job, which is what reviews and your own trial are for: it only maps what each tier charges and expects.

## Why the gaps line up the way they do

The single-shot free tier and the quote-gated enterprise tier are not an accident; they are the same strategy at both ends. The free tool is the acquisition surface (it is how you heard of the vendor), and the enterprise platform is the monetization (it is where the sales team lives). What neither end sells is the quiet middle: a buyer with a handful of vendor SBOMs who wants them watched and will pay a modest subscription for exactly that, without a demo, a security questionnaire about the tool itself, or a contract.

That middle is also where the regulatory pressure lands hardest. FDA section 524B makes the SBOM a statutory requirement for cyber devices; the EU Cyber Resilience Act's main obligations: including machine-readable SBOM documentation: apply from December 2027. A regulated buyer's vendor SBOMs stop being optional files and become a monitored surface, and the tier they can actually buy into is the one that has to exist.

## How to choose, in three questions

**Do you control the source?** If yes, you are not this buyer: a pipeline generator (Syft, Trivy, cdxgen) plus a dev SCA tier is the right answer, and the dev-tier prices in the map are what you should compare.

**Do you have an ops function that wants another system?** If yes, Dependency-Track is free and genuinely good; the cost moves from license to maintenance, which some teams prefer.

**Do you hold vendor SBOMs with nobody to run a server?** Then the standing question is what the daily re-check is worth. The free checker answers what a file contains today ([use it first ->](/tools/sbom-checker)); a watch answers what changed since you last looked ([ours is $99/mo ->](/sbom-shield)). If a watch is what you need and you are evaluating against the enterprise tier, the comparison is not features: it is whether you need a platform or an answer.

## Frequently asked questions

**Can I just check SBOMs manually every month?** You can, and for two vendors it is honest work. The manual check fails at the third vendor and the second quarter: the work is identical every time, the stakes are a missed advisory, and the discipline is exactly what software is for.

**What is the difference between an SBOM check and an SBOM watch?** The check is a query against a file at a moment ([free, browser-side ->](/tools/sbom-checker)). The watch stores the roster and re-runs the query daily against current advisory data, alerting on the diff. The check tells you what you hold; the watch tells you what changed.

**Why is the enterprise tier quote-only?** Because the products bundle platform, onboarding, policy, and account management, and the price is discovered in the sales process. If your need is one product with one function, the quote-gated tier is buying a building when you need a room.

**Is a vendor SBOM watch a substitute for TPRM?** No. A TPRM platform tracks questionnaires, ratings, and financials across a vendor program; a watch answers one question continuously: what is in the software, and what changed. They solve different problems; the watch is often the cheapest thing in the stack and the only one that reads the artifact the vendor actually gave you.

Start with the free check on the files you hold today. [Check a vendor SBOM ->](/tools/sbom-checker)

See what a standing watch does with them. [SBOM Shield ->](/sbom-shield)

---

*The prices and product facts here are each vendor's own published figures or practitioner listings as read in our October 2026 sweep (with the no-price tiers marked as quote-only rather than estimated); our own product is identified as ours with its price stated. Requirements cited reflect FDA section 524B and the EU Cyber Resilience Act as published. All change without notice; verify current terms before purchase. Last verified: October 2026. Have a correction or addition? [Request inclusion or a correction ->]*

Source: https://vendorquals.com/blog/vendor-sbom-monitoring-without-repo-access. This page is also served as HTML at https://vendorquals.com/blog/vendor-sbom-monitoring-without-repo-access.

---
- [All articles](https://vendorquals.com/blog)