Free vulnerability management options include public data sources, open source scanners and free in-browser checks. They cover discovery well. They usually stop at prioritization with your context, ownership tracking, audit evidence and scale across many teams. Decide by what you must prove, not by price.
What can you get for free?
Public vulnerability data. The OSV project describes itself as an open, distributed approach to producing and consuming vulnerability information for open source. It aggregates advisories from sources such as GitHub Security Advisories, PyPA and RustSec, and lists dozens of ecosystems including npm, PyPI, Maven and Go. You can query it by package name and version through an API.
Exploitation signals. CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities exploited in the wild and recommends using it as an input to prioritization. EPSS, from FIRST, gives a free daily probability and percentile of exploitation in the next 30 days for each CVE.
Open source scanners. OSV-Scanner scans SBOMs, lockfiles, directories and container images, and offers guided remediation commands and reusable GitHub workflows for pull request scanning.
Free in-browser checks. For a quick look, our Gold registry has a free in-browser scan at gold.safeguard.sh/scan that covers up to 100 dependencies.
Where do free options stop?
Prioritization with your context. Raw findings number in the hundreds. Free data tells you what is known and sometimes what is exploited. It cannot tell you whether the vulnerable code runs in your application, whether the asset is internet facing or who owns it.
Ownership and workflow. Free tools output lists. Someone must assign each finding, track due dates, chase and close. A spreadsheet works for a handful of projects and breaks beyond that.
History and evidence. An auditor wants dated records of what you scanned and what you did. Scripts can save outputs, but you must design the retention and the audit trail.
Coverage. A scanner reads what you point it at. Finding every repository, image and service in a company is an inventory problem that free scanners do not solve.
Support and accountability. Open source projects run on volunteers and maintainers' time. That is fine for many uses, but there is no service commitment.
Licensing and terms. Read each project's license and data terms. The OSV page we read did not state pricing, and the KEV page refers to a separate license file, so check before you embed anything in a product.
When is free enough?
A small team, a few repositories, no formal audit, and an engineer who likes automation can run well on free sources. Pair a scanner in CI with the exploited vulnerabilities catalog and an EPSS threshold, and review weekly.
Free also works as a pilot. Learn what your findings look like before you pay anyone.
When do you outgrow it?
Signals: findings nobody owns, duplicates across repositories, questionnaires you cannot answer quickly, an audit coming, or a team spending more hours on glue scripts than on fixing. At that point the cost is people's time, not license fees.
How do you decide?
Write down the proofs you must produce, such as dated scans, SLAs by severity and exceptions with approvals. If free tooling plus a modest amount of scripting can produce them, stay. If building and maintaining that would take more than someone's part time attention, evaluate paid options with a pilot.
See how fix guidance can look in the fix available demo.
What to do
- List the proofs and response times you must demonstrate.
- Start with a free scanner in CI on your most important repository.
- Add the exploited vulnerabilities catalog and EPSS to triage.
- Assign an owner to every finding, even if the tracker is a spreadsheet.
- Save dated outputs to a fixed location for audit.
- Review quarterly whether glue work is outgrowing the team.
Quick check
Is free vulnerability data less accurate?
Not necessarily. Many paid products use the same public sources. The difference is context, workflow and evidence, not the raw advisories.
What should I check before relying on a free feed?
Its license and terms of use, how often it updates, and which ecosystems it covers.
Sources
- OSV, Open Source Vulnerabilities, fetched 18 October 2026.
- CISA, Known Exploited Vulnerabilities catalog, fetched 18 October 2026.
- FIRST, EPSS, fetched 18 October 2026.
Last reviewed: 18 October 2026.
