What OSSPREY is
OSSPREY focuses on malware detection in open source repos The vendor site is www.ossprey.com. This profile is an entry in the oneNorma directory, not a vendor landing page.
What OSSPREY covers
OSSPREY is in the catalog for these capabilities. Categories: SCA.
How to evaluate OSSPREY in a security program
Use OSSPREY as a stack candidate, not as diligence evidence. The oneNorma score for OSSPREY is 1.3/10 (percentile 0). If the real gap is in SCA, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what www.ossprey.com publishes. Contrast it with pentesting and Security Cloud & Compliance.