Best firmware vulnerability scanning and SBOM tools for IoT device manufacturers (2026)

The best firmware vulnerability scanning tool for an IoT device manufacturer is one that analyses the binary firmware image without source code, produces an SBOM, ranks vulnerabilities by real exploitation risk, supports VEX and helps with Cyber Resilience Act evidence. Twelve tools are compared below: five commercial platforms, one engineer-delivered service and six open-source projects, with facts read from each vendor's own pages on 26 October 2026.

Disclosure. This page is published by SoftWSP, which is built by Netbase JSC. SoftWSP is included in this list. We compare it with the same criteria and sources as every other entry, and we say where other tools do more.

How we compared the tools

Criterion	Weight	What we checked
Binary firmware without source code	25 %	Does the tool unpack and analyse a firmware image, not only packages or containers?
SBOM and vulnerability prioritisation	25 %	SBOM formats (CycloneDX, SPDX); ranking by CISA KEV, EPSS, reachability or similar
CRA and VEX support	20 %	Article 14 reporting help, technical-file evidence, VEX output
Help to fix	15 %	Does the tool or vendor prepare fixes, or only report?
Price transparency for small teams	15 %	Public price, free tier or open-source licence

The list below is grouped, not ranked: commercial platforms first, then the service, then open source. Within each group the order follows how much of the firmware-specific scope above the tool covers on its own pages. Nobody paid to be listed, and there are no ratings on this page.

Quick comparison

Tool	Binary firmware	SBOM	Prioritisation	VEX	CRA features	Fix help	Price
Finite State	Yes	CycloneDX, SPDX	Reachability, exploit intelligence	Yes	Drafts Art. 14 notifications, technical file	Not publicly listed	Not publicly listed
ONEKEY	Yes	CycloneDX, SPDX 2.3	CVSS environmental, SSVC	Yes	CRA, IEC 62443-4-2, EN 18031 wizard	Customer remediates	Not publicly listed
Cybellum	Yes	SPDX, CycloneDX	EPSS, AI triage	Yes, plus CSAF	CRA evidence templates	Explains mitigations	Not publicly listed
Binarly	Yes	CycloneDX, SPDX	Reachability, EPSS	Yes (OpenVEX)	No dedicated CRA page found	Not publicly listed	Not publicly listed
NetRise Turbine	Yes	Not publicly listed	Reachability, EPSS, KEV	Not publicly listed	CRA readiness reports	Not publicly listed	Not publicly listed
SoftWSP	Yes	Included in the report	CVE, CISA KEV, FIRST EPSS	Not offered yet	Drafts Art. 14 reports	Prepares and tests fixes (with source)	$1,500 per firmware version
EMBA	Yes	CycloneDX	CVE, exploit lookup	Unclear	None	Report only	Free, GPL-3.0
cve-bin-tool	Yes	SPDX, CycloneDX	EPSS	Yes	None	Report only	Free, GPL-3.0
FACT	Yes	Not mentioned	CVE lookup plugin	No	None	Report only	Free, GPL-3.0
Syft + Grype	Partly	CycloneDX, SPDX	EPSS, KEV (Grype)	OpenVEX (Grype)	None	No	Free, Apache-2.0
Dependency-Track	No (ingests SBOMs)	Ingests CycloneDX	EPSS	CycloneDX VEX	None	No	Free, Apache-2.0
unblob	Extraction only	None	None	No	None	No	Free, MIT

Commercial platforms

1. Finite State

Best for: device makers with several product lines who want one platform for binary SBOMs and CRA paperwork. Finite State describes itself as a product security platform for connected devices. It builds SBOMs from firmware and binaries across many instruction sets, exports CycloneDX and SPDX, prioritises by reachability and exploit intelligence, and supports VEX. Its CRA page says it drafts Article 14 notifications for the customer to decide on and file, keeps an SBOM per release and assembles technical-file evidence. It also lists industrial coverage (PLC/SCADA, IEC 62443). SaaS and on-premises; pricing is on request.

2. ONEKEY

Best for: manufacturers who need one compliance view across CRA, IEC 62443-4-2 and EN 18031. ONEKEY states that it analyses firmware without source code or network access, exports CycloneDX and SPDX 2.3, and triages with CVSS environmental scoring, SSVC and VEX. Its Compliance Wizard covers CRA, IEC 62443-4-2 and EN 18031 with an evidence bundle. ONEKEY says remediation stays with the customer. ONEKEY also maintains the open-source extractor unblob, listed below. Pricing is on request.

3. Cybellum

Best for: automotive, medical and industrial device makers who want SBOM, vulnerability and compliance management in one place. Cybellum's product security platform merges SPDX and CycloneDX SBOMs, prioritises with EPSS and an AI triage assistant, issues VEX and CSAF reports, and offers CRA evidence templates. It explains how to fix or mitigate findings but does not change code. It runs in the public cloud or the customer's data centre. Pricing is on request.

4. Binarly Transparency Platform

Best for: hardware OEMs and enterprise buyers analysing compiled firmware, including UEFI and supply-chain risk. Binarly analyses compiled binaries without source, exports CycloneDX and SPDX (plus a cryptographic BOM), ranks findings by reachability, EPSS and its own exploitation-maturity score, and exports VEX. We found no dedicated CRA feature page. SaaS, on-premises or air-gapped. Pricing is not publicly listed.

5. NetRise Turbine

Best for: organisations that buy and operate third-party devices as well as build them. NetRise analyses compiled code and third-party firmware and filters vulnerabilities through reachability, EPSS and CISA KEV. Its CRA page offers release-build SBOMs, vulnerability handling evidence and sample CRA reports. Dragos announced on 21 September 2026 that it acquired NetRise, so product packaging may change. Pricing is not publicly listed.

Engineer-delivered service

6. SoftWSP

Best for: small and mid-size device makers without a security team who want findings explained and, where they own the code, fixed. SoftWSP is a service rather than a self-service platform: we unpack the binary firmware, build the SBOM, match components to the CVE database, CISA KEV and FIRST EPSS, and an engineer reviews every AI-written finding before it reaches you. Where you hold the source code, we prepare the fix, build it, test it and scan again as proof. For the CRA, our PSIRT service drafts early-warning and follow-up reports for you to submit. A Firmware Scan Report costs $1,500 per firmware version (pricing). SoftWSP is young: it does not yet offer VEX output or a self-service portal, and the larger platforms above cover more products at once.

Open-source tools

7. EMBA

Best for: security engineers and pentesters who want a free, full firmware analyser. EMBA extracts firmware, detects binary versions, can emulate parts of the system with QEMU, aggregates CVEs with exploit information and writes a CycloneDX SBOM that can be uploaded to Dependency-Track. GPL-3.0; release v2.0.4 on 21 September 2026.

8. cve-bin-tool

Best for: teams that want a free binary scanner in a build pipeline. cve-bin-tool uses several hundred binary checkers to find known components, reads and writes SPDX and CycloneDX, supports EPSS and produces CSAF, CycloneDX and OpenVEX output. Hosted under the OpenSSF; GPL-3.0; latest stable release v3.4 (September 2024).

9. FACT (Firmware Analysis and Comparison Tool)

Best for: analysts who compare many firmware versions in a web interface. FACT unpacks black-box firmware and runs analysis plugins, including a CVE lookup. It does not produce an SBOM. GPL-3.0; release v4.4.1 on 14 September 2026.

10. Syft and Grype

Best for: generating and scanning SBOMs for Linux root file systems once the firmware is extracted. Syft writes CycloneDX and SPDX in many versions and has cataloguers for ELF and other binaries; Grype matches vulnerabilities with EPSS and KEV and filters with OpenVEX. Neither unpacks firmware images on its own. Apache-2.0; Syft v1.55.0 and Grype v0.121.0 on 19 October 2026.

11. OWASP Dependency-Track

Best for: tracking SBOMs of every shipped firmware version over time. Dependency-Track ingests CycloneDX SBOMs, monitors them against several vulnerability sources with EPSS, and consumes and produces CycloneDX VEX. It does not analyse binaries itself, so pair it with EMBA or Syft. Apache-2.0; release 5.2.1 on 25 October 2026.

12. unblob

Best for: the first step of any open-source pipeline. unblob extracts more than 78 archive and firmware formats so that other tools can analyse the contents. It does not scan for vulnerabilities. MIT; release 26.6.4 on 4 June 2026.

Which tool fits which need

• Many product lines, budget for a platform, CRA paperwork: Finite State, ONEKEY or Cybellum.
• Compiled firmware, UEFI and supply-chain depth: Binarly.
• You build and also operate devices, OT context matters: NetRise, now part of Dragos.
• No security team, want fixes and a fixed price: SoftWSP.
• In-house engineers, no budget: EMBA or cve-bin-tool, with unblob for extraction and Dependency-Track for monitoring.

What no tool does for you

No scanner makes a product compliant with the Cyber Resilience Act. You still need a risk assessment, a support period, a vulnerability disclosure policy, a reporting route and a technical file. Our CRA checklist lists them, and the firmware SBOM guide explains how binary SBOMs are built. Vendor facts change: check each vendor's current pages before you decide.