Cidra

Cidra turns software inventories, release artifacts and API contracts into clear findings — what needs attention, and where you still need answers. No source code required.

The workflow is collect, inspect, decide: choose an input and see exactly which technique will assess it, inspect the observation along with its priority factors and anything the check could not establish, then record a decision and reassess the same scope to see what changed. A complete rescan verifies a change without erasing the decisions your team already made — a finding is the start, understanding it is the point.

Built on open formats and public evidence: CycloneDX, SPDX, OSV, CISA KEV and FIRST EPSS. The public component scan (five components, real advisory lookup) and the local SBOM readiness checker need no account or card. Team is €180 per month including VAT for up to 25 applications with unlimited scans, after a 14-day trial that charges nothing before day 15.