AppSecNews

Top 10
Articles
About
Contact

Browse by category

SAST31 Static Application Security Testing
SCA28 Software Composition Analysis
DAST34 Dynamic Application Security Testing
IAST6 Interactive Application Security Testing
RASP9 Runtime Application Self-Protection
AI Security45 AI and LLM Security
API Security9 API Security
IaC Security17 Infrastructure as Code Security
ASPM16 Application Security Posture Management
Mobile Security23 Mobile Application Security
Container Security8 Container and Image Security
Secret Scanning9 Secret Detection and Scanning
WAF1 Web Application Firewall

Start here

All categories
Top 10 lists by category
Buyer guides and comparisons

Counts are published profiles. Every listing follows the same editorial standard; none are paid for.

Top 10
Articles
About
Contact

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

Filters

License

Open source 2 Open source and commercial 0 Commercial 0 Commercial, free tier 0 Freemium 0 Free 0

Subcategory

Dependency scanning 0 License compliance 0 SBOM generation 0 Container Image Scanning 1 Automated Remediation 0 Policy Enforcement 1 Reachability Analysis 0 Dependency Inventory 0 Dependency Updates 0 Open Source Governance 0 Open Source Inventory 0 Sbom Scanning 1 Snippet Matching 0 Supply Chain Security 0 Advisory Matching 0 Artifact Provenance 0 Artifact Scanning 0 Attribution Generation 0 Automated Fix Prs 0 Backported Patches 0 Behavioral Analysis 0 Binary Analysis 0 Binary Sbom 0 Build Metadata 0 Build Plugin 0 Ci Cd Posture 0 Cli Scanner 1 Client Side Analysis 0 Cloud Readiness 0 Code Property Graph 0 Code To Cloud Lineage 0 Container Sbom 0 Continuous Component Monitoring 1 Cpe Matching 0 Cyclonedx 0 Dependency Prioritization 0 Dependency Remediation 0 Dependency Risk 0 Developer Permissions 0 Developer Security 0 Firmware Analysis 0 Hardened Container Images 0 Impact Analysis 0 Javascript Library Scanning 0 Lockfile Analysis 0 Malicious Package Detection 0 Minimal Base Images 0 Nvd Lookup 0 Open Source Health 0 Open Source Risk 0 Pipelineless Scanning 0 Portfolio Analysis 0 Product Security 0 Pull Request Automation 0 Regulatory Compliance 0 Repository Policy Enforcement 0 Sbom Analysis 1 Sbom Distribution 0 Secret Scanning 0 Static Analysis 0 Supply Chain Provenance 0 Vex Support 1 Vulnerability Alerts 0 Vulnerability Database 0 Vulnerability Management 0 Vulnerability Matching 1 Vulnerability Remediation 0

Deployment

CI/CD 2 CLI 1 SaaS 0 Self hosted 1 Library 0 Container 1 IDE plugin 0 Kubernetes 1 Browser extension 0

Languages

JavaScript 1 Java 1 Python 1 Go 1 Ruby 1 PHP 1 Csharp 0 TypeScript 0 Rust 1 Scala 0 Swift 0 Kotlin 0 C++ 0 Cpp 0 Elixir 0 Dart 0 Abap 0 Clojure 0 Cobol 0

Integrations

Jenkins 2 GitHub Actions 2 GitHub 0 Jira 1 Azure DevOps 0 Bitbucket 0 GitLab 0 Docker 1 Gitlab Ci 2 Maven 0 Npm 0 Artifactory 0 Kubernetes 0 Slack 0 Syft 2 Ant 0 Burp Suite 0 Cdxgen 1 CircleCI 0 Defectdojo 1 Dependency Track 0 Eclipse 0 Gitea 0 Go Modules 0 Gradle 0 Grunt 0 Grype 0 Intellij 0 Nuget 0 Pip 0 Pypi 0 Renovate 0 SonarQube 0 Terraform 0 Visual Studio 0 Zap 0

Maturity

Established 2 Growing 0 Emerging 0

Signals Verified profile 0 Has endorsements 0

Clear

2 tools match

Sort

Active Syft Clear all

Anchore Grype

Anchore

SCA

An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

Open source

Established Compare Anchore Grype
OWASP Dependency-Track

OWASP

SCA

A self-hosted platform that ingests CycloneDX SBOMs and continuously re-evaluates every component against vulnerability and policy data, without rescanning the source.

Open source

Established Compare OWASP Dependency-Track

Anchore Grype

Anchore

An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

Open source Established

SCA Compare Anchore Grype
OWASP Dependency-Track

OWASP

A self-hosted platform that ingests CycloneDX SBOMs and continuously re-evaluates every component against vulnerability and policy data, without rescanning the source.

Open source Established

SCA Compare OWASP Dependency-Track

Tick up to 4 tools above.

Pick at least one more

Other categories

← Static Application Security Testing Dynamic Application Security Testing →

SAST
DAST
IAST
RASP
AI Security
API Security
IaC Security
ASPM
Mobile Security
Container Security
Secret Scanning
WAF

Newsletter

AppSecNews Weekly

New tool profiles, head to head comparisons and guides, in one short email. No tracking pixels, and every issue has a one click unsubscribe. Read past issues

Leave this field empty

Email address

Email me the newsletter. One click in any issue unsubscribes, and the address is never shared or sold. We send a confirmation link first.

AppSecNews

Independent research on application security tooling, written for the people who have to choose it.

editorial policy

Every profile follows one published standard: no pricing, no version claims, no invented ratings, and a limitations section for every tool. Listings are never paid for. Advertising is labelled and never affects placement. Read the policy

2 tools match

Anchore Grype

OWASP Dependency-Track

Anchore Grype

OWASP Dependency-Track