Anchore Secure

Syft is an open source command line tool produced by Anchore that when given a filesystem, such as a Git repo or a container image, generates a high-fidelity SBOM. Syft works at the level of a single artifact and does not persist the data. Anchore Enterprise embeds Syft into its integrations and backend so it can generate the SBOMs for all artifacts in your CI pipelines, registries, or runtime images, and stores the data for vulnerability management, reporting, and remediation workflows.

Grype is an open source command line tool produced by Anchore that takes a single SBOM and generates a list of vulnerabilities. Grype does not store the data and does not perform any continuous scans. Anchore Enterprises use Grype to generate one-off and ongoing vulnerability scans for all SBOMs stored in its database.

Anchore uses a wide variety of feeds to perform the initial and ongoing scans. The complete list can be found in our documentation.

By storing the SBOM for the scanned artifact, Anchore is able to generate a list of vulnerabilities at the time of the SBOM generation but also continue to scan the SBOM as new vulnerabilities are published. As the SBOM is stored in the Anchore database, Anchore can immediately notify a user of new issues without needing to rescan or even have access to the original software. This approach also means you can historically determine if a piece of software that was shipped at some point in the past was susceptible to a vulnerability that has only just come to light.