Anchore

Founded 2016

Scan container images and manage bills of materials to catch vulnerabilities and maintain compliance

Pricing model

Demo

You can use Anchore to track open-source dependencies and manage software bills of materials across your development pipeline. It scans container images, filesystems, and code repositories to detect vulnerabilities, exposed secrets, and malware before deployment. You can enforce security policies throughout your development lifecycle to meet federal standards like NIST and FedRAMP. The system organizes component data into structured formats like SPDX and CycloneDX, making it easy to identify zero-day risks and verify compliance across both internal builds and third-party applications.

What Anchore does

Generate an SBOM from a container imageRun automated vulnerability scans on source code repositoriesImport external CycloneDX and SPDX files into a central catalogScan container images for leaked credentials and secretsApply automated policy checks to block non-compliant containersSearch component inventories for newly disclosed CVEsExport audit reports for FedRAMP and NIST compliance verificationGenerate Software Bills of Materials automatically from containers and filesystemsImport SBOM data in SPDX, CycloneDX, and Syft native formatsScan container images and source repositories for known vulnerabilitiesDetect embedded secrets and malware within application imagesEnforce compliance rules mapped to NIST, FedRAMP, and DISA frameworksTrack open-source and third-party dependencies across application versionsSearch across all stored SBOMs to quickly locate zero-day vulnerabilities