AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

2 tools match

Active Open Source Governance Clear all

  • Revenera FlexNet Code Insight

    Revenera

    SCA

    Compliance oriented composition analysis that combines dependency scanning with source snippet matching against a large open source knowledge base, wrapped in a legal review workflow.

    Commercial
    Established

  • Sonatype Lifecycle

    Sonatype

    SCA

    Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.

    Commercial
    Established

  • Revenera FlexNet Code Insight

    Revenera

    Compliance oriented composition analysis that combines dependency scanning with source snippet matching against a large open source knowledge base, wrapped in a legal review workflow.

    Commercial Established
    SCA

  • Sonatype Lifecycle

    Sonatype

    Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.

    Commercial Established
    SCA
Tick up to 4 tools above.