Comparison
Lockhound and Dependabot
Dependabot is built into GitHub and free, and it does a lot well. Lockhound is not a replacement for it, and you can run both. This page compares what each one does; the right column covers Dependabot and related GitHub features.
Every claim about Dependabot links to its own documentation, checked on 30 October 2026.
| Capability | Lockhound | Dependabot |
|---|---|---|
| Alerts for known vulnerable dependencies | OSV, which includes the GitHub Advisory Database. Free plan: 5 private repositories, unlimited public. | Dependabot alerts, included on all plans.source |
| Malicious package alerts | On by default (OpenSSF Malicious Packages, via OSV), ranked first. | Malware alerts for Composer, Go, Maven, npm, NuGet, pip, RubyGems and Rust; off until you enable them.source |
| Marks vulnerabilities CISA lists as exploited in the wild (KEV) | Shown with the date CISA listed it, ranked first, and alerted when an existing finding is newly listed. | We found no KEV indicator in GitHub's Dependabot or Advisory Database documentation (checked 30 October 2026).source |
| EPSS exploit-probability scores | Shown as a prediction; orders findings within a priority. | Shown on advisories; alerts can be filtered and sorted by EPSS.source |
| Prioritisation | Four documented priorities (malicious or exploited, then severity in code that ships), each with its reasons and sources. | A "Most important" sort that weighs CVSS, dependency scope and detected vulnerable calls.source |
| Reachability analysis | Not offered: Lockhound reads dependency files, not your code. | In public preview, for JavaScript and TypeScript, on GitHub Enterprise Cloud.source |
| Opens pull requests that upgrade dependencies | No. It gives the upgrade command and can open a fix issue; on Business, your AI coding agent can make the fix. | Dependabot security updates and version updates, on all repositories.source |
| Fails pull requests that add vulnerable dependencies | A GitHub check on every plan, public and private, that only counts what the pull request adds. | The dependency review action: all public repositories; private ones need GitHub Code Security or Advanced Security.source |
| Malware committed into the repository itself | Checks the files such attacks hide in (editor tasks, build configs, fonts), on the default branch and in pull requests. | Not found in GitHub's documentation (checked 30 October 2026). Code scanning and secret scanning look for other things.source |
| One view across many GitHub organizations | A workspace connects several organizations and personal accounts; the free plan allows 3. | Security overview, for organizations on GitHub Team or Enterprise; its Dependabot view comes with GitHub Code Security or Secret Protection.source |
| Ecosystems | npm, Yarn, pnpm, Composer, Python (uv, Poetry, Pipenv, pinned requirements), Go, Cargo, Bundler and Gradle lockfiles. | More, including NuGet, Swift, pub and Bazel; some build-time ecosystems need dependency submission.source |
“Partly” means the feature exists with limits, such as a paid plan, a preview or a beta. Products change often; if something here is out of date, tell us and we'll fix it.
When Dependabot alone is enough
If your code lives in a handful of repositories in one organization, you want upgrade pull requests opened for you, and your ecosystems are ones Lockhound doesn't read (such as NuGet or Swift), Dependabot covers you at no cost.
What Lockhound adds
- Exploited in the wild, first. Findings CISA lists as exploited are marked with the listing date and lead the queue, and you are alerted when one you already have gets listed.
- Upgrades checked before you make them. The version Lockhound suggests is itself looked up against every known advisory, and you are told when that release is still vulnerable.
- Pull request checks on private repositories, on every plan, counting only what the pull request adds.
- Malware committed into your code, not just malicious packages.
- One place for every organization you or your clients use.
What about detection rates?
We don't publish “finds X% more” claims. We will only publish detection numbers from a reproducible benchmark (fixed commits, the same time window, the method and raw results published with it). Until then, try both on your own lockfile.