Ortelius

What Ortelius does

Ortelius is an open-source post-deployment vulnerability management platform that maintains a continuously updated digital twin of runtime environments, mapping deployed services, containers, packages, and their dependency topology across clusters without requiring agents or rescans. Its core differentiator is real-time CVE-to-runtime dependency correlation: every ten minutes Ortelius cross-references deployment metadata against the OSV.dev vulnerability database (refreshed every 30 minutes), Operationalizes OpenSSF Scorecard data by tying repository-level security hygiene to actual production usage, and maintains versioned SBOMs as living compliance records. The platform is built on a Go backend (pdvd-backend), a Next.js frontend, and an ArangoDB database, and ships an MCP Server for DevSecOps to support AI-powered CVE mitigation workflows.

The project was contributed by DeployHub to the Continuous Delivery Foundation (a Linux Foundation sub-foundation) as an incubating project in December 2020 and is governed by a community-driven model. It integrates natively with Syft, OpenSSF Scorecard, OSV.dev, SonarQube, Veracode, Helm, Jenkins, and supports both CycloneDX and SPDX SBOM formats. The go-to-market is community-led: distribution is open-source via GitHub, with marketing driven by GitHub, Discord, Google Groups, technical blog content, and events including SecureChainCon, Hacktoberfest, BlogAThon, and OpenSSF Community Days. Commercial monetization flows exclusively through DeployHub's corporate SaaS hosting offering, which provides managed post-deployment vulnerability detection for enterprise buyers. Target customer segments are platform engineers, CISOs and security leadership, DevSecOps teams, and organizations running microservices architectures, with explicit compliance positioning for US federal buyers through NIST 800-53, 800-171, 800-218, and FedRAMP cATO readiness.

Name

Ortelius

Legal name

Ortelius

Website

https://ortelius.io

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

Ortelius is an open-source post-deployment vulnerability management platform under the Continuous Delivery Foundation that correlates CVEs to running production systems via a digital twin, serving platform engineers, CISOs, and DevSecOps teams in microservices environments.

Ownership category

akta.pro rank

Product category

Software Supply Chain Security

NAICS

Computer Systems Design and Related Services (54151), Computer Systems Design Services (541512)

SIC

Services-Prepackaged Software (7372)

akta.pro primary industry

Database/Application Data Layer Modernization (DB migration, ORM, caching) (BPAEAFAL)

akta.pro secondary industry

Data Center Operations & Managed Services (Remote Hands, NOC/SOC) (HDABANAA)

Keywords

• Software supply chain security
• Post-deployment vulnerability management
• Runtime CVE correlation
• SBOM compliance platform
• DevSecOps automation

Headquarters

HQ city

San Francisco

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Infrastructure, Operations

Revenue model

1. Open-Source Community Edition: Free open-source version of Ortelius available on GitHub, managed by the Continuous Delivery Foundation. Community members can contribute, deploy, and use the software at no cost.
2. DeployHub SaaS Hosting: Corporate SaaS hosting support from DeployHub for organizations preferring managed deployment. DeployHub provides post-deployment vulnerability detection platform built on Ortelius core technology.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels7 records

Core offering

Ortelius is an open-source post-deployment vulnerability management platform that maintains a continuously updated digital twin of runtime environments, models deployed services, containers, packages, and dependency topology across clusters, and correlates newly disclosed CVEs with what is actually running in production. The platform runs without agents or rescanning and is delivered free as a community open-source project under the Continuous Delivery Foundation, with corporate SaaS hosting and managed deployment available through DeployHub.

Product overview

Ortelius is an open-source post-deployment vulnerability management platform built as a core project under the Continuous Delivery Foundation. The portfolio consists of the main Ortelius platform (providing real-time CVE-to-runtime dependency correlation using a digital twin approach), supported by the commercial DeployHub SaaS offering for enterprise deployment. Key modules include the Post-Deployment Vulnerability Control Plane for live threat visibility, the Digital Twin for continuous runtime environment modeling, SBOM Versioning for living compliance records, and the OpenSSF Scorecard Dashboard for correlating security hygiene with production usage. The Ortelius MCP Server enables AI-powered CVE mitigation through autonomous agents. DeployHub serves as the corporate SaaS hosting layer for enterprise customers seeking managed infrastructure and expedited remediation patches.

Differentiator

Problem solved

Functional benefit

Products and services

• Ortelius Platform Open-source post-deployment vulnerability management platform providing real-time CVE-to-runtime dependency correlation for live production systems, built on a continuously updated digital twin of the runtime environment. Targeted at platform engineering and security teams.
• DeployHub SaaS Hosting

Quantifiable outcome

• Average remediation timelines stretch beyond 60-100 days; Ortelius enables prioritization of response within hours not weeks
• +2 more outcomes

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration11 records

AI capability9 records

Feature8 records

Partnerships

Six partnerships are on record, tiered core and major.

• Continuous Delivery Foundation (CDF)coreStrategic or Co-development Partner · 8 December 2020Ortelius is managed by the Continuous Delivery Foundation, a vendor-neutral home for CI/CD projects under the Linux Foundation. The CDF provides governance, project oversight, and ecosystem support for Ortelius as an incubating project.
• DeployHubcoreStrategic or Co-development PartnerDeployHub creators of the first microservice management platform, contributed Ortelius as open-source core. DeployHub provides corporate SaaS hosting support for post-deployment vulnerability detection platform built on Ortelius. CEO Tracy Ragan serves on CDF and OpenSSF governing boards.
• OSV.dev (Open Source Vulnerabilities)coreTechnology or IntegrationOrtelius integrates with the OSV database to cross-reference packages for gathering CVE data. Every 30 minutes Ortelius performs an OSV.dev lookup for every package listed in every SBOM to determine if any vulnerabilities exist using OSV public-facing APIs.
• Anchore (Syft)majorTechnology or IntegrationOrtelius integrates with Syft for SBOM generation. Syft CLI tool generates Software Bill of Materials Reports for popular coding languages and package managers including Docker images in CycloneDX format.
• OpenSSF (Open Source Security Foundation)majorStrategic or Co-development PartnerOrtelius operationalizes OpenSSF Scorecard data by correlating repository-level security hygiene with actual usage in production. Tracy Ragan serves on the OpenSSF Governing Board as General Member Representative.
• JenkinsmajorTechnology or IntegrationOrtelius extends Jenkins by adding continuous vulnerability monitoring for deployed applications via Ortelius CI/CD CLI. Captures build metadata, generates SBOMs, and syncs deployment details without disrupting existing CI/CD processes.

Scale indicators4 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• Snyk: Developer-focused security platform offering SCA, SBOM generation, and vulnerability management integrated into CI/CD pipelines. Directly comparable as a build-to-deploy dependency vulnerability tool, though broader in scope and venture-backed at significantly greater scale.
• Anchore: SBOM-first container and software supply chain security platform. Anchore's Syft tool is actually an integration partner for Ortelius, making it the most directly comparable peer in SBOM generation and vulnerability correlation.
• Mend (formerly WhiteSource): Open-source security and license compliance management with SBOM and vulnerability scanning capabilities. Competes for the same platform engineer and security leadership personas across the software supply chain.

Broad incumbents

• Tenable: Established enterprise vulnerability management vendor with Nessus and cloud security offerings. Overlaps with Ortelius in vulnerability prioritization and remediation, but with a much broader portfolio and federal-grade scale.
• Wiz: Cloud security platform rapidly extending into software supply chain and runtime vulnerability detection. Represents the well-capitalized incumbent most likely to compete with Ortelius's post-deployment thesis.
• JFrog Xray: Artifact and software composition analysis tool integrated with JFrog Artifactory. Comparable SBOM, CVE, and dependency scanning capabilities aimed at enterprise DevSecOps teams.
• GitHub Dependabot: Free automated dependency update and vulnerability alerting tool embedded in GitHub. Competes for developer mindshare in SCA and CVE tracking, but limited to build-time data without runtime correlation.

Emerging players

• Chainguard: Supply chain security startup focused on hardened container images and SBOM-backed provenance. Shares the open-source-first, foundation-aligned ethos and competes for the same Kubernetes and cloud-native security buyer.
• Sysdig: Container and runtime security platform that, like Ortelius, focuses on what is actually deployed versus what was built. Comparable in its runtime-visibility thesis, though with a heavier agent-based footprint.
• Aqua Security: Cloud-native application protection platform covering container, Kubernetes, and software supply chain security. Adjacent competitor in runtime vulnerability detection and SBOM-driven compliance.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• GitHubgithub.com/ortelius
• LinkedInlinkedin.com/company/ortelius-open-source
• Xx.com/OrteliusOs

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Ortelius