Cybellum vs Binarly vs NetRise: a firmware security comparison

Last updated: 2026-10-26

Cybellum, Binarly and NetRise all analyse binary firmware without source code, but they lean in different directions: Cybellum towards product security and compliance management for regulated device makers, Binarly towards deep binary and supply-chain analysis with exploitation scoring, and NetRise towards visibility into compiled code and third-party firmware for both builders and buyers. None of the three publishes a price.

Disclosure. This page is published by SoftWSP, which is built by Netbase JSC. SoftWSP appears in the table as a fourth option. Facts about the three vendors come from their own pages, read on 26 October 2026.

Side-by-side

	Cybellum	Binarly	NetRise	SoftWSP
What it is	Product security platform	Transparency Platform for binaries	Turbine visibility platform	Engineer-delivered service
Binary firmware, no source	Yes	Yes	Yes	Yes
SBOM	Merges SPDX and CycloneDX	CycloneDX, SPDX, CBOM	Not publicly listed	Included in report
Prioritisation	EPSS, AI triage assistant	Reachability, EPSS, exploitation maturity	Reachability, EPSS, CISA KEV	CVE, CISA KEV, FIRST EPSS
VEX	Yes, plus CSAF	CycloneDX VEX, OpenVEX	Not publicly listed	Not offered yet
CRA	Evidence templates, regulator reports	No dedicated CRA page found	Readiness reports, sample CRA reports	Drafts Art. 14 reports (PSIRT service)
Fix help	Explains how to fix and mitigate	Not publicly listed	Helps identify and prioritise	Prepares, builds and tests fixes when you hold the source
OT / industrial	Industrial page mentions OT networks	Not publicly listed	xOT visibility claimed	Separate OT Snapshot service
Delivery	Public cloud or own data centre	SaaS, on-prem, air-gapped	Not stated	Remote, worldwide
Target	Automotive, medical, industrial makers	Hardware OEMs, software vendors, enterprise buyers	Builders and buyers, critical infrastructure	Small and mid-size device makers
Price	Not publicly listed	Not publicly listed	Not publicly listed	$1,500 per firmware version

Cybellum

Cybellum's platform covers SBOM management, vulnerability management and compliance management. It merges SBOMs in SPDX and CycloneDX, prioritises with EPSS and an AI triage assistant, and produces VEX and CSAF reports. For the Cyber Resilience Act it offers evidence templates and one-click regulator reports. It explains how to fix or mitigate findings without changing code. It runs in the public cloud or the customer's data centre, agentless.

Binarly

Binarly analyses compiled binaries without source. Its documentation lists CycloneDX and SPDX SBOM export, a cryptographic bill of materials, and VEX export in CycloneDX and OpenVEX. Version 3.0 added real-time threat intelligence and an exploitation-maturity score on top of reachability and EPSS. It can run as SaaS, on-premises or air-gapped. We did not find a dedicated CRA feature page.

NetRise

NetRise Turbine analyses compiled code and third-party firmware and narrows vulnerabilities through reachability, EPSS and CISA KEV. Its CRA page offers release-build SBOMs, vulnerability-handling evidence and sample CRA reports, and it claims visibility across OT and IoT. Dragos announced the acquisition of NetRise on 21 September 2026.

Where SoftWSP fits

SoftWSP is not a fourth platform of the same kind. It is a service for device makers without a security team: we analyse the firmware, an engineer reviews every finding, and where you hold the source we prepare and test the fix and scan again. Prices are published. If you need VEX at scale or a self-service portal across many product lines, the three platforms above do more today. See device firmware security and pricing.

Frequently asked questions

What is the difference between Cybellum, Binarly and NetRise?

All three analyse binary firmware or compiled code. Cybellum focuses on product security and compliance management for automotive, medical and industrial makers; Binarly on deep binary and supply-chain analysis with reachability and exploitation-maturity scoring; NetRise on visibility into compiled code and third-party firmware for builders and buyers, now as part of Dragos.

Which one is best for EU Cyber Resilience Act work?

On their own pages, Cybellum offers CRA evidence templates and regulator reports and NetRise offers CRA readiness reports with sample CRA reports. We found no dedicated CRA feature page for Binarly. None of them states that it files Article 14 reports.

Do Cybellum, Binarly and NetRise support VEX?

Cybellum issues VEX and CSAF reports, and Binarly exports CycloneDX VEX and OpenVEX. NetRise does not state VEX support on the pages we read.

How much do Cybellum, Binarly and NetRise cost?

None of the three publishes a price; all offer demos on request. For comparison, SoftWSP publishes its prices, for example $1,500 for a Firmware Scan Report of one firmware version.

What happened to NetRise?

Dragos announced on 21 September 2026 that it acquired runZero and NetRise. Check the current Dragos and NetRise pages for how the product is sold now.

Who wrote this comparison?

SoftWSP, built by Netbase JSC. SoftWSP is shown in the table as a fourth option. Facts about Cybellum, Binarly and NetRise come from their own websites and documentation, read on 26 October 2026.