The best firmware vulnerability scanning tool for an IoT device manufacturer is one that analyses the binary firmware image without source code, produces an SBOM, ranks vulnerabilities by real exploitation risk, supports VEX and helps with Cyber Resilience Act evidence. Twelve tools are compared below: five commercial platforms, one engineer-delivered service and six open-source projects, with facts read from each vendor's own pages on 26 October 2026.
Disclosure. This page is published by SoftWSP, a brand of Netbase JSC, founded in 2012. SoftWSP is included in this list. We compare it with the same criteria and sources as every other entry, and we say where other tools do more.
How we compared the tools
| Criterion | Weight | What we checked |
|---|---|---|
| Binary firmware without source code | 25 % | Does the tool unpack and analyse a firmware image, not only packages or containers? |
| SBOM and vulnerability prioritisation | 25 % | SBOM formats (CycloneDX, SPDX); ranking by CISA KEV, EPSS, reachability or similar |
| CRA and VEX support | 20 % | Article 14 reporting help, technical-file evidence, VEX output |
| Help to fix | 15 % | Does the tool or vendor prepare fixes, or only report? |
| Price transparency for small teams | 15 % | Public price, free tier or open-source licence |
The list below is grouped, not ranked: commercial platforms first, then the service, then open source. Within each group the order follows how much of the firmware-specific scope above the tool covers on its own pages; it is not a score. Nobody paid to be listed, and there are no ratings on this page.
Quick comparison
| Tool | Binary firmware | SBOM | Prioritisation | VEX | CRA features | Fix help | Price |
|---|---|---|---|---|---|---|---|
| Finite State | Yes | CycloneDX, SPDX | Reachability, exploit intelligence | Yes | Drafts Art. 14 notifications, technical file | Not publicly listed | Not publicly listed |
| ONEKEY | Yes | CycloneDX, SPDX 2.3 | CVSS environmental, SSVC | Yes | CRA, IEC 62443-4-2, EN 18031 wizard | Customer remediates | Not publicly listed |
| Cybellum | Yes | SPDX, CycloneDX | EPSS, AI triage | Yes, plus CSAF | CRA evidence templates | Explains mitigations | Not publicly listed |
| Binarly | Yes | CycloneDX, SPDX | Reachability, EPSS | Yes (OpenVEX) | No dedicated CRA page listed | Not publicly listed | Not publicly listed |
| NetRise Turbine | Yes | Not publicly listed | Reachability, EPSS, KEV | Not publicly listed | CRA readiness reports | Not publicly listed | Not publicly listed |
| SoftWSP | Yes | Included in the report | CVE, CISA KEV, FIRST EPSS | Free VEX generator (CycloneDX, CSAF) | Drafts Art. 14 reports | Prepares and tests fixes (with source) | Published price list: pricing |
| EMBA | Yes | CycloneDX | CVE, exploit lookup | Not publicly listed | None | Report only | Free, GPL-3.0 |
| cve-bin-tool | Yes | SPDX, CycloneDX | EPSS | Yes | None | Report only | Free, GPL-3.0 |
| FACT | Yes | Not publicly listed | CVE lookup plugin | No | None | Report only | Free, GPL-3.0 |
| Syft + Grype | Partly | CycloneDX, SPDX | EPSS, KEV (Grype) | OpenVEX (Grype) | None | No | Free, Apache-2.0 |
| Dependency-Track | No (ingests SBOMs) | Ingests CycloneDX | EPSS | CycloneDX VEX | None | No | Free, Apache-2.0 |
| unblob | Extraction only | None | None | No | None | No | Free, MIT |
Commercial platforms
Finite State
Best for: device makers with several product lines who want one platform for binary SBOMs and CRA paperwork. Finite State describes itself as a product security platform for connected devices. It builds SBOMs from firmware and binaries across many instruction sets, exports CycloneDX and SPDX, prioritises by reachability and exploit intelligence, and supports VEX. Its own CRA page states it provides "draft notifications for each CRA deadline," keeps an SBOM per release and assembles technical-file evidence. It also lists industrial coverage (PLC/SCADA, IEC 62443). SaaS and on-premises; pricing is on request.
ONEKEY
Best for: manufacturers who need one compliance view across CRA, IEC 62443-4-2 and EN 18031. ONEKEY states that it analyses firmware without source code or network access, exports CycloneDX and SPDX 2.3, and triages with CVSS environmental scoring, SSVC and VEX. Its own Compliance Wizard page says the tool "guides teams through each provision of the guideline selected for the firmware," covering CRA, IEC 62443-4-2 and EN 18031 with an evidence bundle. ONEKEY says remediation stays with the customer. ONEKEY also maintains the open-source extractor unblob, listed below. Pricing is on request.
Cybellum
Best for: automotive, medical and industrial device makers who want SBOM, vulnerability and compliance management in one place. Cybellum describes its own platform as able to "create and manage reliable, complete assets & SBOMs from multiple sources, merge, auto-fix and validate SBOMs." It merges SPDX and CycloneDX SBOMs, prioritises with EPSS and an AI triage assistant, issues VEX and CSAF reports, and offers CRA evidence templates. It explains how to fix or mitigate findings but does not change code. It runs in the public cloud or the customer's data centre. Pricing is on request.
Binarly Transparency Platform
Best for: hardware OEMs and enterprise buyers analysing compiled firmware, including UEFI and supply-chain risk. Binarly's own documentation describes the goal as "ground-truth visibility into compiled software and firmware... without source code access." It analyses compiled binaries without source, exports CycloneDX and SPDX (plus a cryptographic BOM), ranks findings by reachability, EPSS and its own exploitation-maturity score, and exports VEX. On 26 October 2026, Binarly's public site had no page dedicated to CRA. SaaS, on-premises or air-gapped. Pricing is not publicly listed.
NetRise Turbine
Best for: organisations that buy and operate third-party devices as well as build them. NetRise analyses compiled code and third-party firmware and filters vulnerabilities through reachability, EPSS and CISA KEV. Its own CRA page says it helps teams "prepare for EU CRA obligations with evidence based on binary artifacts rather than source code," offering release-build SBOMs, vulnerability handling evidence and sample CRA reports. Dragos announced on 21 September 2026 that it acquired NetRise, so product packaging may change. Pricing is not publicly listed.
Engineer-delivered service
SoftWSP
Best for: small and mid-size device makers without a security team who want findings explained and, where they own the code, fixed. SoftWSP is a service rather than a self-service platform: we unpack the binary firmware, build the SBOM, match components to the CVE database, CISA KEV and FIRST EPSS, and an engineer reviews every AI-written finding before it reaches you. Where you hold the source code, we prepare the fix, build it, test it and scan again as proof. For the CRA, our PSIRT service drafts early-warning and follow-up reports for you to submit. Fixed-scope report prices are on the pricing page. VEX documents in CycloneDX and CSAF are produced with the free VEX generator, one statement at a time, and the service report carries the SBOM and the reviewed findings. For one self-service view across many product lines, the platforms above are built for that.
Open-source tools
EMBA
Best for: security engineers and pentesters who want a free, full firmware analyser. EMBA, described on its own GitHub page as "the security analyzer for firmware of embedded devices," extracts firmware, detects binary versions, can emulate parts of the system with QEMU, aggregates CVEs with exploit information and writes a CycloneDX SBOM that can be uploaded to Dependency-Track. GPL-3.0; release v2.0.4 on 21 September 2026.
cve-bin-tool
Best for: teams that want a free binary scanner in a build pipeline. cve-bin-tool, described on its own GitHub page as a tool that "helps you determine if your system includes known vulnerabilities," uses several hundred binary checkers to find known components, reads and writes SPDX and CycloneDX, supports EPSS and produces CSAF, CycloneDX and OpenVEX output. Hosted under the OpenSSF; GPL-3.0; latest stable release v3.4 (September 2024).
FACT (Firmware Analysis and Comparison Tool)
Best for: analysts who compare many firmware versions in a web interface. FACT, short for "Firmware Analysis and Comparison Tool" per its own GitHub page, unpacks black-box firmware and runs analysis plugins, including a CVE lookup. It does not produce an SBOM. GPL-3.0; release v4.4.1 on 14 September 2026.
Syft and Grype
Best for: generating and scanning SBOMs for Linux root file systems once the firmware is extracted. Anchore's own GitHub page describes Syft as a "CLI tool and library for generating a Software Bill of Materials from container images and filesystems"; it writes CycloneDX and SPDX in many versions and has cataloguers for ELF and other binaries. Grype matches vulnerabilities with EPSS and KEV and filters with OpenVEX. Neither unpacks firmware images on its own. Apache-2.0; Syft v1.55.0 and Grype v0.121.0 on 19 October 2026.
OWASP Dependency-Track
Best for: tracking SBOMs of every shipped firmware version over time. OWASP's own project page describes Dependency-Track as "an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain." It ingests CycloneDX SBOMs, monitors them against several vulnerability sources with EPSS, and consumes and produces CycloneDX VEX. It does not analyse binaries itself, so pair it with EMBA or Syft. Apache-2.0; release 5.2.1 on 25 October 2026.
unblob
Best for: the first step of any open-source pipeline. unblob, described on its own GitHub page as an "accurate, fast, and easy-to-use extraction suite for binary blobs," extracts more than 78 archive and firmware formats so that other tools can analyse the contents. It does not scan for vulnerabilities. MIT; release 26.6.4 on 4 June 2026.
Which tool fits which need?
- Many product lines, budget for a platform, CRA paperwork: Finite State, ONEKEY or Cybellum.
- Compiled firmware, UEFI and supply-chain depth: Binarly.
- You build and also operate devices, OT context matters: NetRise, now part of Dragos.
- No security team, want fixes and a fixed price: SoftWSP.
- In-house engineers, no budget: EMBA or cve-bin-tool, with unblob for extraction and Dependency-Track for monitoring.
What no tool does for you
No scanner makes a product compliant with the Cyber Resilience Act. You still need a risk assessment, a support period, a vulnerability disclosure policy, a reporting route and a technical file. Our CRA checklist lists them, and the firmware SBOM guide explains how binary SBOMs are built. Our services cover the parts a scanner leaves open: fixing, re-scanning as proof, monitoring and PSIRT reporting. Vendor facts change: check each vendor's current pages before you decide.
Frequently asked questions
What is the best firmware vulnerability scanning tool for IoT device manufacturers?
It depends on the team. Device makers that want one platform for binary SBOMs, VEX and CRA reporting across many products look at Finite State, ONEKEY, Cybellum, Binarly or NetRise. Small teams without security staff may prefer a service that also prepares fixes, such as SoftWSP. Teams with in-house skills can start free with EMBA or cve-bin-tool.
Can these tools scan firmware without source code?
The five commercial platforms, SoftWSP, EMBA, FACT and cve-bin-tool all state that they work on binary firmware. Syft, Grype, Trivy and Dependency-Track are built for packages, containers and SBOMs rather than unpacking firmware images, and unblob only extracts firmware so other tools can analyse it.
Which tools help with the EU Cyber Resilience Act?
Finite State's own CRA page states it provides "draft notifications for each CRA deadline" and assembles a technical file; ONEKEY's Compliance Wizard page says it "guides teams through each provision of the guideline selected for the firmware"; Cybellum and NetRise offer CRA evidence or readiness reports; SoftWSP drafts early-warning and follow-up reports for the manufacturer to submit. No open-source tool in this list claims CRA features. None of them makes a product compliant; the manufacturer stays responsible.
Are there free firmware vulnerability scanners?
Yes. EMBA (GPL-3.0), FACT (GPL-3.0), cve-bin-tool (GPL-3.0), Syft and Grype (Apache-2.0), Dependency-Track (Apache-2.0) and unblob (MIT) are open source. They need engineering time to install, tune and read the results.
Do any of these tools fix the vulnerabilities they find?
The commercial platforms report, prioritise and in Cybellum's case explain mitigations; ONEKEY states that remediation stays with the customer. SoftWSP is the one entry that prepares, builds and tests the fix itself when the device maker holds the source code.
How was this list put together?
From each vendor's or project's own website, documentation and GitHub releases, read on 26 October 2026, against five published criteria. Facts that are not public are marked Not publicly listed. SoftWSP is built by Netbase JSC, the publisher of this page.
Related reading
Sources
- Finite State: platform, CRA and industrial pages (read 26 Oct 2026)
- ONEKEY: SBOM management, vulnerability management and Compliance Wizard (read 26 Oct 2026)
- Cybellum: platform page (read 26 Oct 2026)
- Cybellum: platform, SBOM and compliance management (read 26 Oct 2026)
- Binarly documentation: why Binarly (read 26 Oct 2026)
- Binarly documentation: SBOM and VEX export (read 26 Oct 2026)
- NetRise: EU CRA compliance (read 26 Oct 2026)
- Dragos press release: Dragos acquires runZero and NetRise (read 26 Oct 2026)
- EMBA on GitHub, releases and wiki (read 26 Oct 2026)
- cve-bin-tool on GitHub (read 26 Oct 2026)
- FACT_core on GitHub (read 26 Oct 2026)
- Anchore: Syft on GitHub (read 26 Oct 2026)
- Anchore: Syft SBOM formats and Grype (read 26 Oct 2026)
- OWASP Dependency-Track on GitHub (read 26 Oct 2026)
- OWASP Dependency-Track documentation (read 26 Oct 2026)
- unblob on GitHub (read 26 Oct 2026)
- Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex