DefectDojo

What it is

An OWASP Flagship project and web platform that collects results from security scanners into one place, so teams can triage, deduplicate, and track findings across products and engagements. The open-source Community Edition is BSD-3-Clause, and the company behind it sells DefectDojo Pro.

What it helps with

- Importing results from many security scanners into one findings database
- Deduplicating findings and tracking them across products, engagements, and tests
- Managing remediation status through the web UI and REST API
- Running vulnerability management as part of DevSecOps workflows

Who it's for

AppSec, product security, and vulnerability management teams that run several scanners and need one place to manage what they find.

Worth knowing

The open-source edition runs as a self-hosted server with Docker Compose. It uses local accounts; SSO (SAML, OIDC, OAuth), LDAP, and MFA are Pro features. Pro adds a new UI, risk-based prioritization, API connectors, and SaaS or Kubernetes hosting.

Is DefectDojo free?
The Community Edition is free and open source under BSD-3-Clause. DefectDojo Pro is a paid commercial edition.

How does it relate to Trivy, Grype, or Greenbone?
In our view they fit together: Trivy, Grype, and Greenbone find vulnerabilities, while DefectDojo collects and manages the findings from scanners like them.