# Feature comparison

**DefectDojo Open-Source** is a powerful, free vulnerability management platform with core importing, deduplication, basic dashboards, API access, and essential reporting — ideal for smaller teams or those wanting to self-host and extend the tool using community resources.

**DefectDojo Pro** builds on that foundation with enterprise-oriented features such as advanced dashboards and reporting, automation and scripting via rules engine, connectors to many security tools, optimized import workflows, unified SOC & AppSec support, improved UI/UX, AI integration, enhanced security (SSO/MFA), and premium support options.

| Feature / Capability       | DefectDojo Open-Source                                   | DefectDojo Pro                                             |
|----------------------------|---------------------------------------------------------|-----------------------------------------------------------|
| Core vulnerability management| ✔️ Import, track, and manage findings from 200+ security tools | ✔️ Everything in open-source, optimized for scale          |
| Finding deduplication      | ✔️ Standard deduplication                                 | ✔️ Advanced, configurable deduplication                      |
| REST API                  | ✔️ Full REST API                                        | ✔️ Full REST API                                          |
| Authentication & access control| ✔️ Local auth and basic RBAC                         | ✔️ SSO (SAML/OAuth), MFA, advanced RBAC                   |
| User interface             | ✔️ Community UI                                        | ✔️ Modern Pro UI with performance improvements               |
| Dashboards & reporting     | ✔️ Basic dashboards and reports                          | ✔️ Advanced, customizable dashboards and executive reporting|
| Automation & workflows     | ❌ Not included                                         | ✔️ Rules Engine and automated workflows                    |
| Import enhancements        | ❌ Standard imports only                                 | ✔️ Background imports, Smart Upload, Universal Parser, CLI uploads|
| Tool integrations          | ❌ Manual/API-driven                                    | ✔️ Built-in **API Connectors** for popular AppSec and cloud tools|
| Jira integration           | ✔️ Included                                            | ✔️ Included                                              |
| Project management integrations| ❌ Not included                                    | ✔️ integrate with **Azure Devops**, **GitHub**, **GitLab** and **ServiceNow**|
| Finding enhancements       | ❌ Not included                                         | ✔️ Automatic KEV, EPSS scoring and Ransomware tracking    |
| SOC & AppSec unification   | ❌ AppSec-focused only                                   | ✔️ Unified AppSec and SOC findings                        |
| AI & next-generation features| ❌ Not included                                       | ✔️ AI-assisted workflows, reporting and MCP support       |
| Support                    | Community support (GitHub, Slack, forums)              | Commercial support with SLAs                               |
| Hosting options            | Self-hosted                                           | Self-hosted or cloud-hosted