Sold by: ReversingLabs
Deployed on AWS
Spectra Assure detects malware, tampering, and exposed secrets in the software you build and buy. It analyzes the final software package, whether a binary, container, or AI model, with no source code required, so you can vet third-party and commercial software before deployment. Integrations with CI/CD, cloud, and ITSM tools automate testing and enforce policies across your software supply chain.
4.7
Overview
Secure the Software You Build, Buy, and Deploy
Classic AppSec and SCA tools focus on known vulnerabilities in open-source code. Today's supply chain attacks, including malware, tampering, and exposed secrets, hide inside the compiled software that actually ships and runs your business.
ReversingLabs Spectra Assure analyzes software in the form it is delivered, whether a binary, package, container, or AI model, with no source code required. It rapidly deconstructs large, complex software packages, recursively inspecting embedded files, dependencies, and layers to find threats that legacy scanners miss. Software producers use it to stop issues before release, and enterprise software buyers use it to vet third-party and commercial software before deployment or update.
Secure Third-Party and Commercial Software
- No source code required: Analyze the final software package so you can vet vendor and commercial software your teams did not build
- Accelerate software approvals: Automate pre-deployment evaluations to speed onboarding while enforcing internal policies
- Share findings with suppliers: Securely share reports with software vendors to collaborate on fixes
Detect Real Threats, Not Just Vulnerabilities
- Malware and threat detection: Powered by the world's largest threat intelligence database covering over 400 billion files and 16 proprietary malware detection engines
- Tampering identification: Flag suspicious changes between versions and failed reproducible build verification before software leaves the build environment
- Exposed secrets: Prioritize active SaaS credentials found in the final build, with noise reduction from threat repository data
- Open-source context: Continuous analysis of more than 6 million packages across popular registries separates real threats from noise
Assess and Improve Your Risk Posture
- SAFE report: Get a comprehensive SBOM and risk assessment for every application, with findings prioritized by threat level
- Go beyond the SBOM: Generate CycloneDX and SPDX SBOMs, plus SaaSBOM, ML-BOM, and CBOM
- SAFE Levels: Benchmark software against measurable milestones and follow a customizable remediation roadmap
- Verify every release: Differential analysis confirms each new version improves without introducing new risks
Integrate Into Existing Workflows
- Automate testing, enforce policies, and establish security guardrails with out-of-the-box APIs, customizable CLIs, and integrations for CI/CD, cloud, and ITSM tools
Getting Started To discuss your requirements, custom pricing, EULA terms, or a private offer, contact sales@reversinglabs.com or request a private offer through AWS Marketplace.
Highlights
- Binary-Level Software Bill of Materials: Generate SBOMs from the final software package, not just manifest files, to see every open-source and third-party component in the software you build or buy, with no source code required. Recursive inspection of embedded files, dependencies, and layers reveals what dependency-graph tools miss, and SBOMs export in CycloneDX and SPDX, plus SaaSBOM, ML-BOM, and CBOM.
- Malicious Behavior Detection: Detect malware, tampering, and suspicious behaviors that SCA tools miss, powered by a threat intelligence database covering over 400 billion files and 16 proprietary malware detection engines. Spectra Assure deconstructs full software binaries in seconds to minutes, flags suspicious changes between versions, and surfaces actionable alerts curated by ReversingLabs threat researchers.
- Secrets Leakage Prevention: Find exposed secrets in the final build before software reaches production or downstream customers. Spectra Assure prioritizes active SaaS credentials and reduces noise using threat repository data, so security teams focus on the most critical exposures first, respond faster, and enforce policies that stop leaked secrets from shipping.
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
RL SSCS 0-10GB/month | RL Software Supply Chain Security Platform - 0-10 GB per month | $75,000.00 |
RL SSCS 10-25GB/month | RL Software Supply Chain Security Platform - 10-25 GB per month | $135,000.00 |
RL SSCS 25-50GB/month | RL Software Supply Chain Security Platform - 25-50 GB per month | $216,000.00 |
RL SSCS 50-100GB/month | RL Software Supply Chain Security Platform - 50-100 GB per month | $324,000.00 |
RL SSCS 100-250GB/month | RL Software Supply Chain Security Platform - 100-250 GB per month | $450,000.00 |
RL SSCS 250-500GB/month | RL Software Supply Chain Security Platform -250-500 GB per month | $600,000.00 |
RL SSCS 500-1000GB/month | RL Software Supply Chain Security Platform - 500-1000 GB per month | $700,000.00 |
Dimensions summary
You buy the Spectra Assure platform under a contract based on how much software you scan each month, measured in gigabytes. The seven dimensions are monthly volume bands: 0-10GB, 10-25GB, 25-50GB, 50-100GB, 100-250GB, 250-500GB, and 500-1000GB. You pick the band that matches your expected monthly scanning volume. As your volume grows, you move to a higher band. The tiers cover the same platform; they differ only by the amount of data processed per month. Contracts run for a year or multiple years.
Top-of-mind questions for buyers
The volume measures the size of software packages you scan each month. Spectra Assure analyzes compiled binaries, open-source packages, and commercial software without needing source code. Each package you submit for analysis adds its file size to your monthly total, which must fall within your chosen band.
Each band covers a set monthly range in gigabytes. If your usage grows past your band's upper limit, you move to a higher band. You can contact the vendor to adjust your contract, and they can pro-rate the change during your term.
No. All seven bands cover the same Spectra Assure platform. They differ only by the gigabytes of software processed per month. Capabilities like malware detection, tampering detection, exposed secret detection, and xBOM generation stay the same across bands.
www.reversinglabs.com+2
Helpful?
Vendor refund policy
No refunds are available
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Support
Vendor support
ReversingLabs provides technical support 24/7/365 for Software Supply Chain Security products, including Spectra Assure.
Contact Support Existing customers requiring support with ReversingLabs products and services can reach the support team through either channel below.
- Phone: +1 617 250 7518, option 2
- Email: support@reversinglabs.com
Self-Service Resources
- Product documentation: https://docs.secure.software
- Learning Lab: https://www.reversinglabs.com/learning-with-reversinglabs
Product documentation includes integration guides, API references, and policy details to help you get started and troubleshoot common issues. The Learning Lab offers training materials to help your team build expertise with ReversingLabs products.
For questions about pricing, licensing, or private offers, contact sales@reversinglabs.com .
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By ReversingLabs
By Checkmarx
By Sonatype
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Software Bill of Materials Generation
Continuous collection of software bills of material (SBOMs) in CycloneDX and SPDX formats with component supplier, version, and dependency relationship tracking
Multi-Format File Scanning
Scanning of hundreds of file formats to identify embedded threats, malware, and suspicious behavioral changes in executables, components, and dependencies
CI/CD and Tool Integration
Integration with CI/CD, cloud, and ITSM tools to automate security testing, enforce policies, and establish security guardrails
Risk-Based Policy Enforcement
Automatic enforcement of risk-based policy controls with verification of severe issue remediation, security posture tracking, and custom scanning configuration
Secrets Detection and Suppression
Detection and prioritization of exposed secrets and sensitive information with alert suppression capabilities to reduce noise and improve response times
Static Application Security Testing
Identifies vulnerabilities and weaknesses in custom code with support for 25+ languages and frameworks, scanning uncompiled code and re-scanning only new or modified code.
Software Composition Analysis
Identifies and prioritizes open source vulnerabilities, takes inventory of open source components and dependencies, and evaluates risks of open source licenses with severity metrics and remediation guidance.
Infrastructure as Code Analysis
Detects security misconfigurations in IaC templates using KICS to prevent errors such as open storage buckets, insecure databases, and excessive privileges before deployment.
Real-time IDE Security Scanning
Provides real-time vulnerability identification during IDE development for both human-generated and AI-generated code, detecting vulnerabilities, unmasked secrets, vulnerable container images, and malicious open source packages.
Agentic-AI Remediation
Generates remediated code suggestions using Agentic-AI that accesses proprietary databases and customized AI models, allowing developers to accept changes or interact with the AI agent for vulnerability remediation guidance.
Continuous Vulnerability Monitoring
Continuously monitors and alerts for security, legal, and quality risks at every stage of the software development lifecycle with custom policy enforcement.
Automated Dependency Management
Automatically remediates violations with guaranteed non-breaking fixes and provides automated waiver generation for violations without viable remediation paths.
Reachability Analysis Engine
Leverages reachability analysis to prioritize remediation efforts across the organization and improve fix rates with targeted remediation guidance.
Software Bill of Materials Generation
Generates accurate Software Bill of Materials (SBOMs) and discovers open source components in container images with continuous monitoring and policy-driven enforcement.
AI/ML Model Governance
Provides AI Software Composition Analysis with visibility and control over AI/ML model usage including model-level license support.
Standard contract
No
No
Customer reviews
Computer Software
Deep File Reputation Intelligence with Excellent Format Coverage
Reviewed on Mar 26, 2026
Review provided by G2
What do you like best about the product?
The depth of their file reputation intelligence. We integrate ReversingLabs' file reputation service into our CDR pipeline, and the quality of the verdicts, particularly for complex or obfusive file types, is a clear differentiator. The coverage across file formats is excellent and aligns well with the threat landscape.
What do you dislike about the product?
Honestly, it's hard to find significant dislikes - the core product does what we need it to do well. If anything, we'd love to see more proactive sharing of threat intelligence insights and research from the ReversingLabs team. Their expertise in file-based threats is clearly deep, and more of that knowledge surfaced to partners would add real value.
What problems is the product solving and how is that benefiting you?
File-based threats are our entire focus, and ReversingLabs gives us the reputation intelligence to back our CDR capability with an additional layer of validated threat data. The benefit is simple - better outcomes for our customers and a stronger, more defensible product.
Computer Software
Very good, with small drawbacks in the interface
Reviewed on Feb 04, 2026
Review provided by G2
What do you like best about the product?
I primarily use Spectra Analyze to check files that come up during the discovery phase, such as open directories, that trigger honeypot alarms, etc.
Disclaimer: I received access as part of my role as a Security Researcher.
I have been using Spectra Analyze for about 1 year now for ~6 hours a week.
Let's start with the interface. There are exactly 2 things that personally bother me.
1. There is no dark mode or I haven't found it.
2. The main dashboard is sometimes overloaded - this also applies to other areas - more on that later.
Otherwise, I must say I find the interface successful. It looks clean, in most cases you immediately see what the status is, and it is thematically well sorted. There are other providers where you feel like you have 10 popups before you find the information. That is not the case here. For some things, like contacted URLs, I would wish for a copy button. That would simplify things a bit more. Otherwise, you have to click 2x more and still get the information - please understand this more as "complaining at a high level."
File Upload
You can upload the data via the GUI or via API. Personally, I have used the GUI now and then, but relatively quickly built an upload script based on the available SDK and now upload 99.9% via API to ReversingLabs.
File Report
On the overview page of the individual file, you immediately see what exactly is going on. Classification, which part (static analysis, dynamic analysis, etc.) rated the file, a graph, network information if available, and much more can be seen at first glance. If you want, you can also get lost in the respective sub-items. Personally, the overview page is usually enough for me.
YARA
What I find pretty good is that I can store my own YARA rules. A "matching" also takes place for files that were uploaded in the past. It is immediately apparent which ones match, you can adjust your rule, etc. - in short, pretty solid.
Support & Feedback
This is the point that surprised me the most. Whether general inquiries or hints about what I didn't like - it was always answered promptly. I was particularly surprised that some requests for possible interface improvements were added within a very short time. I know it differently from other large companies. If I had to give stars, it would be 4.5.
Disclaimer: I received access as part of my role as a Security Researcher.
I have been using Spectra Analyze for about 1 year now for ~6 hours a week.
Let's start with the interface. There are exactly 2 things that personally bother me.
1. There is no dark mode or I haven't found it.
2. The main dashboard is sometimes overloaded - this also applies to other areas - more on that later.
Otherwise, I must say I find the interface successful. It looks clean, in most cases you immediately see what the status is, and it is thematically well sorted. There are other providers where you feel like you have 10 popups before you find the information. That is not the case here. For some things, like contacted URLs, I would wish for a copy button. That would simplify things a bit more. Otherwise, you have to click 2x more and still get the information - please understand this more as "complaining at a high level."
File Upload
You can upload the data via the GUI or via API. Personally, I have used the GUI now and then, but relatively quickly built an upload script based on the available SDK and now upload 99.9% via API to ReversingLabs.
File Report
On the overview page of the individual file, you immediately see what exactly is going on. Classification, which part (static analysis, dynamic analysis, etc.) rated the file, a graph, network information if available, and much more can be seen at first glance. If you want, you can also get lost in the respective sub-items. Personally, the overview page is usually enough for me.
YARA
What I find pretty good is that I can store my own YARA rules. A "matching" also takes place for files that were uploaded in the past. It is immediately apparent which ones match, you can adjust your rule, etc. - in short, pretty solid.
Support & Feedback
This is the point that surprised me the most. Whether general inquiries or hints about what I didn't like - it was always answered promptly. I was particularly surprised that some requests for possible interface improvements were added within a very short time. I know it differently from other large companies. If I had to give stars, it would be 4.5.
What do you dislike about the product?
-no dark mode
-Interface partially (due to the amount of data) confusing
-Interface partially (due to the amount of data) confusing
What problems is the product solving and how is that benefiting you?
Since I use the toolset as a security researcher and not in a corporate environment, I cannot identify any business-related issues.
Computer & Network Security
Comprehensive, Clear, and Backed by Great Support
Reviewed on Nov 16, 2025
Review provided by G2
What do you like best about the product?
Comprehensive, clear, great customer support!
What do you dislike about the product?
Nothing in particular. Probably the UI could be nicer, but it's not blocking anything.
What problems is the product solving and how is that benefiting you?
Getting more information about possible malware
Maria C.
Seamless Onboarding and Premium Risk Management
Reviewed on Nov 14, 2025
Review provided by G2
What do you like best about the product?
I find the onboarding process with ReversingLabs to be magnificent, as everyone was super involved in addressing our specific needs. They demonstrated high availability and provided very useful tips on how to best utilize our plan. The initial setup of ReversingLabs was extremely easy, making the transition seamless and efficient. Moreover, the process of prioritizing risk management and enriching information with ReversingLabs is highly effective. Overall, I am extremely satisfied with the functionality and support provided, which is why I rate ReversingLabs a perfect 10 and would highly recommend it.
What do you dislike about the product?
Endpoints for checking usage are a bit confusing.
What problems is the product solving and how is that benefiting you?
I use ReversingLabs for analyzing IOCs and malware, which helps prioritize risk management and enrich information.
Tim M.
I evaluated the entire market category and chose RL for my business!
Reviewed on Apr 22, 2025
Review provided by G2
What do you like best about the product?
RL has an industry leading, humongous repository of both known bad (malware) and known good files (it's critical to have both). At the time of this review they have approximately 40 billion files and support more file types and larger files (including containers and archives like ISO and ZIP) than anyone else.
What do you dislike about the product?
I do hope that, one day, RL will have a community facing website similar to VT to allow independent and not-yet-customers to see the value in their repository and analysis directly.
What problems is the product solving and how is that benefiting you?
RL allows me to receive a very accurate, third-party opinion of executable and other types of files involved in detections on my customers' endpoint devices, and they do this analysis for me (for files already in their massive repository) in a few milliseconds, which aligns with my company's mission of making verdicts on detected threats in milliseconds.