When the next Log4j lands, the blast radius is a query.
Ingest SPDX and CycloneDX bills of materials from your build pipeline, inventory every open-source component across every service, and search them by component and version range, traced through base images and images to the hosts, pods and OS that run them, with OSS-license data where the SBOM carries it. "Where does that library run?" stops being a fire drill and becomes a search box.
⚡ Premium add-on module · join the waitlist
Your software supply chain, inventoried.
Discovery accounts for the infrastructure; Software Composition accounts for what runs on it, every library, its version, its license, and the images and hosts it runs on.
SBOM ingestion · SPDX & CycloneDX
Push bills of materials straight from CI in the two standard formats. Omnitam parses and reconciles them against the estate discovery already maintains.
Open-source component inventory
Every open-source component you ship, catalogued in one place, name, version, supplier, and the services it appears in, instead of scattered across repos.
Dependency & version mapping
Which service runs which version of which library, and what that library in turn depends on. Transitive dependencies included, not just the top level.
Version-range search
Find every image and host running log4j-core 2.0 to 2.14.1. Bring the advisory from your scanner or feed; Omnitam resolves the version range to the exact base images, images, hosts and pods it reaches.
OSS license inventory
GPL, LGPL, MIT, Apache, and the rest: the license each SBOM declares, recorded with every component and searchable before legal or an acquirer's diligence team asks. Automated obligation and copyleft analysis is planned.
Supply-chain exposure, in context
See how much of your fleet shares a component, and trace it from image to running ECS tasks to hosts on an end-of-life OS. Ranked supply-chain risk reports, covering unmaintained packages and concentration risk, are on the roadmap.
One component. Every service it touches.
Search a library and Omnitam resolves it to the services running it, the versions in play, the images and hosts they run on, and the license data that comes with it.
| service | version | image | host / OS | license |
|---|---|---|---|---|
| payments-api | 2.14.1 | payments-api:3.2 | ip-10-0-4-17 · Amazon Linux 2023 | Apache-2.0 |
| orders-worker | 2.17.2 | orders-worker:1.9 | eks pod · Ubuntu 22.04 | Apache-2.0 |
| search-index | 2.17.2 | search-index:5.0 | eks pod · Debian 12 | Apache-2.0 |
| legacy-report | 2.11.0 | legacy-report:0.8 | ip-10-0-9-3 · CentOS 7 · end-of-life | Apache-2.0 |
Answer the question before it's urgent.
Zero-day, zero panic
The day an advisory names a library and a version range, the matching services, images, hosts, and owners are one search away, not a week of grepping build manifests across teams.
License data, on hand early
Every component arrives with the license its SBOM declares, so a shipping decision or an acquisition's diligence starts from facts. Automated copyleft and obligation analysis is planned.
One estate, infra to library
Composition sits beside discovery in the same system of record, so a library maps straight to the resource it runs on and the team that owns it.
About Software Composition.
Which SBOM formats can I ingest?
The two industry standards: SPDX and CycloneDX. Generate them in your build pipeline and push them to Omnitam over the API; they're parsed, versioned, and reconciled against the discovered estate.
Do you scan my source, or ingest what I produce?
Omnitam ingests the SBOMs your pipeline already produces, no source access, no build agent. That keeps the discovery model consistent: read-only, nothing installed, you stay in control of what's shared.
Does Omnitam match components to CVEs?
No. Omnitam is not a vulnerability scanner. It keeps the component inventory that scanners such as Amazon Inspector or Snyk report against: what runs where, and which components and versions it contains. Take the library and affected version range from your scanner or advisory, search it, and get the matching images, hosts, pods, OS and owners.
Does this help with the EU Cyber Resilience Act?
The CRA emphasises exactly this kind of evidence: a queryable, evidence-grade component inventory built from the SPDX and CycloneDX SBOMs your CI already produces. See Omnitam for the EU Cyber Resilience Act for how the pieces fit together.
Is it a premium add-on?
Yes, SBOM is a premium add-on module, available on Essential and above. Module pricing is published when trials open; join the waitlist to hear first.
Know what you ship, down to the library.
Push your first SBOM when trials open and see every component, version, and license resolve to the images, hosts, and services that run them.