SCA
Identify open-source dependencies and match them against known vulnerability and license data.
28 tools profiled
How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.
Arnica
A source-control-native application security platform that scans dependencies, secrets and code changes on push and pushes findings to the committing developer in chat.
Black Duck Software
A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.
CAST
A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.
Endor Labs
A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.
Finite State
A product security platform that unpacks firmware and binaries to generate SBOMs and identify component vulnerabilities in connected devices where no source code is available.
FOSSA
A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.
JFrog
A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.
Arnica
A source-control-native application security platform that scans dependencies, secrets and code changes on push and pushes findings to the committing developer in chat.
Black Duck Software
A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.
CAST
A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.
Endor Labs
A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.
Finite State
A product security platform that unpacks firmware and binaries to generate SBOMs and identify component vulnerabilities in connected devices where no source code is available.
FOSSA
A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.
JFrog
A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.
Mend.io
A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.
OpenText
A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.
OWASP
A self-hosted platform that ingests CycloneDX SBOMs and continuously re-evaluates every component against vulnerability and policy data, without rescanning the source.
Qwiet AI
Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.
Revenera
Compliance oriented composition analysis that combines dependency scanning with source snippet matching against a large open source knowledge base, wrapped in a legal review workflow.
Snyk
Resolves the full dependency tree including transitives, matches it against a curated vulnerability database, and raises fix pull requests with the minimum viable upgrade path.
Sonatype
Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.
Mend.io
A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.
OpenText
A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.
OWASP
A self-hosted platform that ingests CycloneDX SBOMs and continuously re-evaluates every component against vulnerability and policy data, without rescanning the source.
Qwiet AI
Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.
Revenera
Compliance oriented composition analysis that combines dependency scanning with source snippet matching against a large open source knowledge base, wrapped in a legal review workflow.
Snyk
Resolves the full dependency tree including transitives, matches it against a curated vulnerability database, and raises fix pull requests with the minimum viable upgrade path.
Sonatype
Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.