AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

4 tools match

Active Container Image Scanning Clear all

  • Anchore

    Anchore

    SCA

    An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

    Open source and commercial
    Established

  • Anchore Grype

    Anchore

    SCA

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source
    Established

  • Snyk

    Snyk

    SCA

    Resolves the full dependency tree including transitives, matches it against a curated vulnerability database, and raises fix pull requests with the minimum viable upgrade path.

    Freemium
    Established

  • Syft

    Anchore

    SCA

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source
    Established

  • Anchore

    Anchore

    An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

    Open source and commercial Established
    SCA

  • Anchore Grype

    Anchore

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source Established
    SCA

  • Snyk

    Snyk

    Resolves the full dependency tree including transitives, matches it against a curated vulnerability database, and raises fix pull requests with the minimum viable upgrade path.

    Freemium Established
    SCA

  • Syft

    Anchore

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source Established
    SCA
Tick up to 4 tools above.