AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

2 tools match

Active Open Source Inventory Clear all

  • Black Duck

    Black Duck Software

    SCA

    A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.

    Commercial
    Established

  • SCANOSS

    SCANOSS

    SCA

    Open source composition analysis engine that fingerprints code at snippet level using winnowing hashes and matches it against a knowledge base you can query as a service or host yourself.

    Freemium
    Growing

  • Black Duck

    Black Duck Software

    A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.

    Commercial Established
    SCA

  • SCANOSS

    SCANOSS

    Open source composition analysis engine that fingerprints code at snippet level using winnowing hashes and matches it against a knowledge base you can query as a service or host yourself.

    Freemium Growing
    SCA
Tick up to 4 tools above.