ARGUS: SBOM Management & Software Supply Chain Security Platform

Complete software composition analysis with dual-engine vulnerability scanning. ARGUS generates your Software Bill of Materials, finds and prioritises vulnerabilities, and enforces policy in your CI/CD pipelines, all deployable 100% on-premise.

  • CycloneDX 1.5 & SPDX 2.3
  • Grype + Trivy dual-engine
  • EPSS & KEV enrichment
  • On-premise & air-gapped
Request a Demo Download Brochure contact@mphatek.com
ARGUS SBOM security dashboard showing risk score, vulnerability distribution and component inventory
  • 2,700+Components / scan
  • 7Compliance frameworks
  • 2Scan engines
  • 5Output formats

Know every component in your software, and every risk inside it

ARGUS is an enterprise software supply chain security platform with Software Bill of Materials (SBOM) management. It maps your applications, libraries, frameworks, dependencies and components, analyses them with two independent vulnerability engines, and turns the results into prioritised, audit-ready action.

Built for banking, financial and other regulated enterprises, ARGUS runs entirely inside your environment, including air-gapped networks.

Talk to our team Read the FAQ
ARGUS SBOM platform dashboardZoom

What is an SBOM?

A Software Bill of Materials is a comprehensive inventory of every component in your software: libraries, frameworks, packages and their dependencies.

Why SBOM matters

Rising supply chain attacks

Software supply chain attacks increased 742% from 2019 to 2024 (Sonatype).

Regulation is here

U.S. Executive Order 14028 mandates SBOM for federal software suppliers, and the EU Cyber Resilience Act requires component transparency for digital products.

Banking mandates

RBI Master Directions (April 2024) require complete software component visibility for Indian banks.

What ARGUS delivers

Secure, automated SBOM generation through to policy enforcement and board-ready reporting.

Automated SBOM generation

Secure and automated SBOM generation in CycloneDX 1.5 and SPDX 2.3 formats.

Multi-target scanning

Scan Docker images, Git repositories, file systems and package manifests from one platform.

VEX & license compliance

Auto-generated CycloneDX VEX per CVE, plus SPDX license IDs per component with copyleft risk assessment for legal review.

Policy governance gate

Built-in policy governance with CI/CD pass / warn / fail gating for Jenkins, GitHub Actions, GitLab CI and Azure DevOps.

SBOM diff & comparison

Compare any two scans to track supply chain drift, with a risk direction indicator (improving or degrading).

Compliance mapping

RBI, CERT-In, PCI DSS, NIST, EO 14028 and EU CRA compliance mapping to support audits.

Real-time dashboard

Vulnerability trends, risk metrics and CVSS v3.1 severity classification with deduplicated results.

100% on-premise & air-gapped

Deploy fully inside your environment with bank-grade security controls such as rate limiting and IP whitelisting.

API & webhook integration

API-based integration and webhook notifications to fit ARGUS into your existing DevSecOps tooling.

Dual-engine vulnerability scanning

Two independent engines, enriched with real-world exploit intelligence, so you fix what matters first.

Grype engine (Anchore)

Matches SBOM components against NVD, GitHub Advisory, OSV and RHSA databases. CVSSv3.1 scoring with fix-version tracking, cross-referencing PURL identifiers for precise matching.

Trivy engine (Aqua Security)

Independent vulnerability detection with container layer analysis, covering OS packages, language-specific libraries and configuration issues. Results are cross-correlated and deduplicated.

EPSS enrichment (FIRST.org)

Exploit Prediction Scoring lets you prioritise remediation by actual exploit likelihood, not just CVSS severity.

KEV flagging (CISA)

Flags Known Exploited Vulnerabilities from CISA’s catalog, identifying CVEs actively exploited in the wild for immediate action and escalation.

Supported scan targets

Scan containers, code, servers and manifests across the ecosystems you use.

Target typeSupported sourcesAuthentication
Container imagesDocker Hub, AWS ECR, Google GCR, Azure ACR, Harbor, GHCR, Quay.io, all OCI registriesUsername/Password, IAM roles
Git repositoriesGitHub, GitLab, Bitbucket, Azure DevOps, any Git URLUsername/Token, SSH keys
File systemsLocal paths, mounted volumes, network shares, remote servers (SSH)OS-level or SSH credentials
Package manifestspackage.json, requirements.txt, pom.xml, go.mod, Gemfile, Cargo.toml, etc.None required

Component inventory supports npm, pip, Maven, Go, Rust, NuGet, Ruby, PHP and 30+ ecosystems.

Scan results & analysis

Complete visibility into your software supply chain.

Vulnerability analysis

CVE ID, severity badge, CVSS score and vector, affected package, installed vs. fix version, EPSS percentile, KEV status and source engine, with a summary of average CVSS, max CVSS and fixable count.

Component inventory

Complete package list with name, version, type, PURL identifier, SHA-256 hash and license SPDX ID.

VEX documents

Auto-generated CycloneDX VEX with exploitability status per CVE (exploitable, not_affected, under_investigation), response code and affected PURL. Machine-readable for automation.

License compliance

Classification into Permissive (MIT, Apache), Copyleft (GPL, LGPL), Commercial and Unknown, with copyleft risk assessment for legal review.

Output formats

Machine-readable for automation, board-ready for leadership.

FormatStandardUse case
CycloneDX 1.5 JSONOWASP CycloneDXPrimary SBOM format: components, hashes, licenses, PURLs
SPDX 2.3 JSONLinux Foundation SPDXCompliance-focused: license mapping, supplier relationships
VEX documentCycloneDX VEX 1.5Vulnerability status per CVE: machine-readable exploitability
PDF executive reportARGUS proprietaryPer-scan report with charts, risk score and remediation plan
Portfolio PDF reportARGUS proprietaryCross-portfolio 27-page board-ready report (13 sections)

Policy governance gate for CI/CD

8 built-in security policies stop risky builds before they ship.

Built-in policies include

  • Critical CVE gate: fail if any critical vulnerability is found
  • High CVSS threshold: fail if max CVSS is at or above a configurable threshold
  • Copyleft license gate: warn or fail on GPL, LGPL and AGPL components
  • CISA 2025 compliance: verify all minimum SBOM elements are present

Plugs into your pipeline

  • Returns HTTP 200 (pass) or 403 (fail)
  • Works with Jenkins, GitHub Actions, GitLab CI and Azure DevOps
  • API key authentication for secure CI/CD integration
  • SBOM diff shows drift between any two scans

From code to compliance

A simple loop that fits into everyday DevSecOps.

  1. Scan

    Point ARGUS at container images, Git repositories, file systems or manifests.

  2. Analyse

    Generate the SBOM, run Grype and Trivy, then enrich with EPSS and KEV.

  3. Enforce

    Apply policy gates in your CI/CD pipeline with pass, warn or fail results.

  4. Report & track

    Export SBOM, VEX and PDF reports, and compare scans to track improvement.

ARGUS brochure

Read the details online or download the PDF to share with your team.

Download Brochure Open in new tab

ARGUS FAQ

Quick answers on SBOM, scanning, compliance and deployment.

What is ARGUS?

ARGUS is mPHATEK’s enterprise software supply chain security platform. It generates Software Bills of Materials (SBOMs), runs dual-engine vulnerability scanning and enforces security policies in your CI/CD pipelines, with 100% on-premise and air-gapped deployment.

What is an SBOM?

A Software Bill of Materials (SBOM) is a comprehensive inventory of every component in your software, including libraries, frameworks, packages and their dependencies.

Which SBOM formats does ARGUS support?

ARGUS generates SBOMs in CycloneDX 1.5 JSON and SPDX 2.3 JSON. It also produces CycloneDX VEX documents, a per-scan PDF executive report and a cross-portfolio PDF report.

How does ARGUS find vulnerabilities?

ARGUS uses two independent engines, Grype (Anchore) and Trivy (Aqua Security), and cross-correlates and deduplicates their results. Findings are enriched with EPSS exploit probability and flagged against the CISA Known Exploited Vulnerabilities (KEV) catalog.

Can ARGUS run on-premise or air-gapped?

Yes. ARGUS supports 100% on-premise and air-gapped deployment, with bank-grade security controls such as rate limiting and IP whitelisting.

Does ARGUS integrate with CI/CD pipelines?

Yes. The built-in policy governance gate returns HTTP 200 for pass and 403 for fail, so it works with Jenkins, GitHub Actions, GitLab CI and Azure DevOps. ARGUS also offers API-based integration and webhook notifications.

Which regulations and standards does ARGUS map to?

ARGUS provides compliance mapping for RBI, CERT-In, PCI DSS, NIST, Executive Order 14028 and the EU Cyber Resilience Act, and includes a CISA 2025 policy that verifies all minimum SBOM elements are present.

How can I get an ARGUS demo or proof of concept?

Use the enquiry form on this page, email contact@mphatek.com or visit our Contact Us page to request a demo or a proof-of-concept deployment.

Ready to secure your software supply chain?

Contact us for a demo or proof-of-concept deployment of ARGUS.

Submitting opens your email app with this message ready to send to contact@mphatek.com.

See every component. Fix what matters first.

Request a demo of ARGUS and bring SBOM visibility and policy control to your pipelines.

Request a Demo