Finite State vs Scribe Security once the firmware image has no signed SBOM
Finite State when the artifact in hand is the firmware image. Scribe Security when CI should sign an in-toto attestation and a later check should find it.
A firmware image can ship with no signed SBOM, and the release job can stay green if nothing in CI checked an attestation. Those are two jobs on the same release. Firmware analysis says what is in the image. A CI attestation says a later check can find a signature for the target the pipeline was given. A team can need both.
Finite State takes the firmware image, a binary, source when you have it, and a supplier SBOM you want checked against that image. Scribe Security’s Valint actions take an image, a directory, a file, or a git repo in CI, write a signed in-toto attestation, and let a later verify step look for that attestation. An image nobody uploaded has no firmware-grounded SBOM from Finite State. A job that never ran the attest step has nothing signed for that Scribe check. Neither gap cancels the other.
The sections below set the Finite State order form next to the Scribe Hub contract on AWS Marketplace, sold by Scribe Security, which was the purchase listing checked 3 Oct 2026. scribesecurity.com returned HTTP 404 that day. A 404 is not a purchasing status, and it does not show that Scribe Security is unavailable. If the question is source-only dependency scanning, that comparison is SCA tools.
Overview
| Primary use case | Analyze a customer-provided firmware image and keep an SBOM of what that image contains | Sign an in-toto attestation for a CI target, then verify that attestation later |
|---|---|---|
| What you hand it | A firmware image, a binary, source, a third-party SBOM, or a CI upload into the platform | An image, a directory, a file, or a git repo, plus the token or key the action uses to sign |
| Record produced | A CycloneDX or SPDX SBOM from the analyzed artifacts, plus vulnerability and reachability context on the platform | A signed in-toto attestation (CycloneDX SBOM or SLSA provenance) stored with Scribe or in an OCI registry |
| What leaves the check idle | No upload of the image that shipped. A supplier SBOM that was never reconciled to that image. AgentOS policy gates, which the 17 February 2026 announcement still called a private preview | No attest step before verify. The default Gatekeeper rule, which warns on an unsigned image instead of refusing it. A rule set to error only refuses when you turn that level on |
| Day-to-day workflow | Someone uploads the firmware image, or a pipeline sends it. The platform writes the SBOM and keeps it across releases | CI runs valint bom with output attest, then valint verify, or an admission webhook looks for that evidence |
| License/pricing | Order form. No public dollar. Quarterly true-up on extra scans and uploads. See Editions | AWS Marketplace 12-month contract by developer count. See Editions |
| Who operates it | Whoever holds the firmware image and the order form that allots uploads | Whoever puts the attest action in the workflow and decides whether an unsigned image is a warning or a refusal |
We read the Finite State customer terms effective 1 July 2026, the platform docs, and the February 2026 announcement. We read the Scribe Security Valint verify README, the evidence action README, the Gatekeeper provider README, and the AWS Marketplace listing for Scribe Hub. All of that was on 3 Oct 2026. We did not install either product, so this is not a hands-on benchmark.
Finite State
Scribe Hub on AWS Marketplace
Finite State, Inc. is the company named on those customer terms and on the February 2026 announcement. It acquired MergeBase on 27 June 2024. MergeBase is source SCA in that lineage. The column stays Finite State. Scribe Security is the seller name on the AWS Marketplace listing opened the same day. No closed acquisition announcement was found, so the column stays Scribe Security.
Editions and pricing
Finite State fees sit on an order form. No dollar rate was on the terms page checked 3 Oct 2026. The public Scribe Hub figures were on the AWS Marketplace listing sold by Scribe Security.
| How you buy it now | An order form for the Finite State Platform, which the terms define as software that analyzes customer-provided firmware images. Professional and managed services are a separate line on that form. If the form names no duration, the default term is 12 months, then it renews unless a party gives 30 days’ notice | Scribe Hub on AWS Marketplace, sold by Scribe Security, as a 12-month SaaS contract. The listing had no customer reviews |
|---|---|---|
| Public price (3 Oct 2026) | No dollar amount. Fees are in USD on the invoice, due in 30 days. A scan or upload past the allotment is a pro-rata true-up, invoiced at the end of that quarter | $0 USD for 1 user of Scribe Hub for 30 days. $48,000 USD per 12 months for Scribe Hub, up to 50 developers. $96,000 USD per 12 months for Scribe Hub, up to 150 developers. The contract length on the listing is 12 months, and the listing says no refunds. A generic SaaS note about monthly usage fees is not a second price |
| What the count includes | The order form allots scans and uploads. The terms define one firmware image as the software for a single make and model, typically under 2GB. Going past the allotment is the quarterly true-up | The 12-month dimensions count developers, up to 50 or up to 150. They do not describe a per-image or per-attestation meter |
| Main buying consideration | How many firmware uploads the order form allots, and whether managed services are on that same form | Whether this release needs the firmware upload on the Finite State order form and the 12-month Scribe Hub developer band (50 or 150) on the same order |
What the firmware image yields
The Finite State terms call the platform software that analyzes firmware images the customer provides. Platform docs list ingestion by file upload, repo connection, CI hook, third-party scan, or API, then binary and source analysis, then a CycloneDX or SPDX SBOM you can export. The ground-truth description says those component entries come from the firmware, the binary, or the source, and that a supplier SBOM can be normalized and checked against the image. A supplier file that never meets the image stays a claim.
The byline on that post reads 16 February 2026. The dateline reads 17 February 2026. The same post still says the expanded platform is in private preview, and it says the platform reduces vulnerability noise by up to 90% through reachability. That 90% figure is Finite State’s, on that post. AgentOS is the orchestration piece in the announcement. It is not the firmware-analysis column in the table above.
Those platform docs describe policy checks and CI hooks. An in-toto attestation or a Sigstore check on the SBOM was not found on those pages. That gap is not a finding that Finite State has no signing control outside the pages opened.
What CI signs and checks
| Where the SBOM comes from | Analysis of the firmware image, binary, or source the customer uploaded, exportable as CycloneDX or SPDX | valint bom on an image, directory, file, or git target. Output attest is the signed in-toto form. A statement is the unsigned form |
|---|---|---|
| What gets signed | Not found on the platform docs or the customer terms opened 3 Oct 2026 | The attestation. Default config named in the verify action is sigstore-github (Sigstore, including GitHub workload identity). x509 is the other config the same README lists |
| What a missing signature does | A signature check was not found, so a missing signature is not a documented fail condition on those pages | The Gatekeeper provider README installs a default rule that warns on any unsigned image. The example that refuses admission sets that rule’s level to error. The sample log in the README, stamped 11 March 2024, shows the error rule failing because no evidence was found |
| Main buying consideration | Do you have the firmware image that shipped, and will someone upload it? | Is the attest action in the workflow, and is unsigned set to warning or to error? |
The verify action looks for an SBOM attestation or an SLSA attestation on the target. The evidence action can attach a third-party CycloneDX file and sign it. That is how an SBOM made somewhere else becomes signed evidence. A failed lookup of a host named in those READMEs is not evidence Scribe Hub is unavailable. The purchase path checked on 3 Oct 2026 is the AWS Marketplace listing. The Gatekeeper install notes also say the cluster’s Gatekeeper build should be newer than 3.15.0 if you use the external-data webhook.
Where they overlap
Both can end with a CycloneDX SBOM, and a release can need both. Finite State builds that file from the firmware image and can fold in source and a supplier SBOM. Scribe Security builds one from the CI target, or accepts a third-party CycloneDX and signs it. A signed copy of a Finite State export is the attestation job applied to the firmware job. It is not a reason to drop either product. Name which file an auditor treats as the SBOM, and which signature has to be present. Vulnerability context and reachability live on the Finite State side of that file. The signature, the SLSA provenance, and the admission rule live on the Scribe Security side.
When to use both
Keep Finite State on the device image after it is built, including a supplier SBOM you want checked against that image. Keep Scribe Security on the pipeline that should sign the attestation for the image, directory, file, or git repo it was given. Export CycloneDX from Finite State and attach that file with the Scribe evidence action if you want the signature on that export. The two products do not sync a record by themselves. Name the file that counts.
Use Finite State when you can hand over the firmware image and the SBOM has to come from what is in that image, on an order form that allots uploads and true-ups the extras each quarter. Use Scribe Hub when the pipeline should run valint bom with output attest, and you will set the unsigned rule to error if a warning is not enough. Use both when the image has to be analyzed and the pipeline has to carry a signed attestation for that release. Scribe Hub remains the contract on the AWS Marketplace listing sold by Scribe Security. The HTTP 404 on the marketing host is not a finding that the listing is closed.
FAQs
Does uploading the firmware image sign the release?
An in-toto attestation or a Sigstore check was not found on the Finite State pages opened 3 Oct 2026. Those pages describe analysis of the image and a CycloneDX or SPDX export. Scribe’s Valint step does describe signing. That is a boundary in the pages opened, not a proof that Finite State has no signing control elsewhere.
Does Scribe Security decompose a device firmware image?
A firmware inventory reconciled to a supplier SBOM was not found in the Valint verify README. That README lists an image, a directory, a file, or a git repo. The reconciliation is described on the Finite State side. Not finding it in the README is not a finding that Scribe Hub cannot open a firmware file.
What public prices were checkable?
No dollar amount on the Finite State terms. The only public contract figures were the AWS Marketplace 12-month dimensions in Editions, counted by developers. Those figures are the listing until a contract repeats them.
Is AgentOS the column in the table?
No. The column is the Finite State Platform that analyzes firmware images. The February 2026 announcement still called the AgentOS expansion a private preview. The byline and the dateline on that post differ by one day.
Is this the source SCA comparison?
No. Source-only dependency scanning is the SCA tools comparison. Finite State versus Scribe Security is firmware analysis and CI attestations, two jobs that can both be required on one release.
Is this a hands-on bake-off?
No. The comparison uses the terms, the platform docs, the February 2026 announcement, three public Valint READMEs, and the AWS Marketplace listing. Nobody installed either product for this page.
