SolarWinds NCM alternative: inventory, topology, compliance, CVE and end of life, read-only

NacTrack reads your devices over SSH, with each vendor's own show commands, and derives inventory, topology, configuration compliance, CVE exposure and end of support. It only needs a read account and writes nothing to the device. SolarWinds Network Configuration Manager (NCM) is first a change management tool: it backs up and deploys configurations. If your question is "what do we have, what is it exposed to, what is out of support", here is why NacTrack answers it better.

Free network audit See the demo

Verified on 2026-10-13 against SolarWinds' public documentation and NacTrack's code. Features change: sources are listed at the bottom of the page.

Why choose NacTrack

Six reasons, each with the page that shows it.

Read-only by design

NacTrack only runs show commands and refuses to answer any device prompt that could change its state, whereas NCM is built to send configurations to devices [2][7]. Installation and operations

One product, one collection

Inventory, CDP and LLDP topology, compliance, CVE and end of life come from the same collection, whereas SolarWinds mapping is a separate product, Network Topology Mapper [6]. Topology

Compliance that shows the evidence

586 named rules in 18 rule sets per platform, and every failure cites the rule and the configuration extract that triggered it. Compliance

CVE by exact version

Each CVE is matched to the version read on the device and cross-checked with the CISA KEV list and the EPSS score; in NCM, firmware vulnerability detection is disabled by default [4]. Vulnerabilities

Published coverage, empty cells included

Cisco, Huawei, Aruba, Dell, Fortinet, F5, Infoblox and Forcepoint collected over SSH, Juniper and Palo Alto from an exported configuration, with a matrix that also says what is not covered; we found no official public list of the vendors NCM supports. Vendor matrix

An appliance on your premises, support in French

NacTrack installs on your hardware with its whole stack on one machine, with no Windows server or separate SQL Server database to plan for as NCM requires in production [8], and the vendor answers tickets in French and English, on Morocco business hours. What the installation needs

Comparison table

Criterion	NacTrack	SolarWinds NCM
Access to devices	Read account, SSH, no agent; nothing is written to the device [N1][N8]	Device templates holding each device type's commands, used to download and upload configs [2]
Topology	Rebuilt on every collection from CDP and LLDP neighbours, cross-checked with MAC and ARP tables [N1]; recursive discovery from a single device [N3]	Not described on the NCM page. SolarWinds offers it in a separate product, Network Topology Mapper (ICMP, SNMP, WMI, CDP) [6]
Compliance	586 rules in 18 rule sets per platform; every failure cites the rule and the config extract; waivers supported; custom rules not yet open; no automatic remediation [N4]	Policy reports, editable example reports, custom rules, remediation scripts [3]; DISA STIG, NIST FISMA, HIPAA, PCI DSS named [1]
CVE	Matched to the exact version read on the device; catalogue built from NVD, Cisco PSIRT, CISA KEV and EPSS; SMUs and config conditions not evaluated; no findings for Huawei VRP yet [N5]	NIST data, detection for Cisco IOS, IOS XE, IOS XR, ASA, Nexus and Juniper; disabled by default [4]
Vendors	8 vendors collected over SSH (Cisco, Huawei, Aruba, Dell, Fortinet, F5, Infoblox, Forcepoint), Juniper Junos and Palo Alto PAN-OS by import; coverage matrix published with its empty cells, Arista EOS not collected [N2]	Multi-vendor networks per the product page [1]; default device templates that can be copied and customised [2]. No official public list found
Deployment	Appliance on your hardware: NacTrack ISO (AlmaLinux 9 or Debian, LUKS2 disk encryption) or an Ubuntu VM; the whole stack on one machine, no high availability [N8]	Self-hosted: Windows Server 2016 to 2025, SQL Server (or Azure SQL) database on a separate server in production [8]; also included in SolarWinds Observability Self-Hosted [1]
End of life (EoS, EoL)	Hand-curated catalogue matched by vendor and model; a missing model shows as "no data", never guessed [N6]	Automatic import of end-of-sale and end-of-support data for Cisco, and for Palo Alto since release 2025.4 [5]
Backup and restore	Configuration kept on every collection, diff between two collections, download as text and as .patch; no restore to the device [N7]	Scheduled backups and roll back to a last-known-good version [1]
Configuration push	No, by design [N1]	Yes: command scripts and config change templates applied to one or many devices, scheduled jobs [1][7]
NacTrack outbound flows	Daily licence validation, mandatory (read-only after 30 days without it); CVE and end-of-life catalogues (vendor, model or version, device count), can be switched off; error reports on by default, can be switched off [N9]	(not compared)
Licence model	Subscription: platform, per-device licence per year in decreasing tiers, extra tenants, 1 to 3 year term; no per-user cost [N10]	By number of managed nodes, tiers from DL50 to DLX (unlimited) [9]
Public price	No amount published: quote [N10]	No amount on the product page as of 2026-10-13: quote, 30-day trial [1]

When SolarWinds NCM fits

You need to push configuration changes to many devices, with templates, variables and scheduling [1][7]. NacTrack does not do this.
You want to restore an earlier configuration onto the device, or attach a remediation script to a compliance rule [1][3].
You already run the SolarWinds platform and want configuration management in the same console.

Frequently asked questions

Can NacTrack replace SolarWinds NCM?

Not for change management: NacTrack does not push configuration, restore an earlier version or run remediation scripts. To know what you have, what it is exposed to and what is out of support, it replaces a hand-maintained inventory and gives, in one product, the topology, compliance, CVE and end of support read from each device.

What access does NacTrack need on devices?

A read account, reached over SSH from the management network. On Cisco, if an enable password is supplied, collection enters enable mode to read the configuration; without it, collection continues and flags the refused configuration. No agent is installed and no write access is requested, which limits what the collection account can do on your network.

Can NacTrack and NCM run together?

Yes. NCM keeps the changes, NacTrack gives the real state of the estate, its compliance and its exposure. NacTrack only needs a read account and writes nothing to the device, so it gets in the way of no change in progress.

What data leaves a NacTrack installation?

By default: licence validation, daily; catalogue sync for CVE and end of life, which sends vendor, model or version and the number of devices, with no named device; application error reports, with the page and the trace. Only the licence is mandatory, the rest can be switched off. Configurations and credentials are not sent. The full list is on the Sovereign by design page.

Does NacTrack cover Huawei?

Collection, inventory, topology and compliance, yes, on Huawei VRP. CVE matching does not return findings for VRP yet, because NVD does not reference that operating system. The vendor matrix states it cell by cell, and it is the thing to read before choosing.

Sources

Trademarks are cited for identification only; SolarWinds and Network Configuration Manager are trademarks of their owner.

Judge NacTrack on your own estate

A one-day, read-only network audit is offered free of charge, and the demo shows the product on sample data.

Request the free audit See the demo