SCA
Identify open-source dependencies and match them against known vulnerability and license data.
28 tools profiled
How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.
Arnica
A source-control-native application security platform that scans dependencies, secrets and code changes on push and pushes findings to the committing developer in chat.
Black Duck Software
A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.
CAST
A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.
Chainguard
A supplier of minimal, continuously rebuilt container images and language dependencies that ship with signatures, provenance and SBOMs to cut vulnerability backlog at the source.
Crash Override
A supply chain platform built around build-time artifact marking, linking running workloads back to the source code, pipeline and people that produced them.
Endor Labs
A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.
Finite State
A product security platform that unpacks firmware and binaries to generate SBOMs and identify component vulnerabilities in connected devices where no source code is available.
FOSSA
A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.
GitHub
GitHub's built-in dependency scanner and update bot, matching your dependency graph against the GitHub Advisory Database and opening pull requests that bump vulnerable packages.
JFrog
A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.
Arnica
A source-control-native application security platform that scans dependencies, secrets and code changes on push and pushes findings to the committing developer in chat.
Black Duck Software
A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.
CAST
A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.
Chainguard
A supplier of minimal, continuously rebuilt container images and language dependencies that ship with signatures, provenance and SBOMs to cut vulnerability backlog at the source.
Crash Override
A supply chain platform built around build-time artifact marking, linking running workloads back to the source code, pipeline and people that produced them.
Endor Labs
A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.
Finite State
A product security platform that unpacks firmware and binaries to generate SBOMs and identify component vulnerabilities in connected devices where no source code is available.
FOSSA
A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.
GitHub
GitHub's built-in dependency scanner and update bot, matching your dependency graph against the GitHub Advisory Database and opening pull requests that bump vulnerable packages.
JFrog
A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.
Mend.io
A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.
OpenText
A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.
Qwiet AI
Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.
Mend
Dependency update bot that detects outdated packages across dozens of package managers and raises pull requests to bump them, with grouping, scheduling and automerge rules.
SCANOSS
Open source composition analysis engine that fingerprints code at snippet level using winnowing hashes and matches it against a knowledge base you can query as a service or host yourself.
Seal Security
Supplies security backports for vulnerable open source packages so a fix can be applied on the version you already run, avoiding the breaking upgrade path.
Snyk
Resolves the full dependency tree including transitives, matches it against a curated vulnerability database, and raises fix pull requests with the minimum viable upgrade path.
Socket
Analyzes what a package actually does, including install scripts, network and filesystem access and obfuscated code, to catch supply chain attacks that advisory based scanners never see.
Sonatype
Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.
Mend.io
A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.
OpenText
A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.
Qwiet AI
Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.
Mend
Dependency update bot that detects outdated packages across dozens of package managers and raises pull requests to bump them, with grouping, scheduling and automerge rules.
SCANOSS
Open source composition analysis engine that fingerprints code at snippet level using winnowing hashes and matches it against a knowledge base you can query as a service or host yourself.
Seal Security
Supplies security backports for vulnerable open source packages so a fix can be applied on the version you already run, avoiding the breaking upgrade path.
Snyk
Resolves the full dependency tree including transitives, matches it against a curated vulnerability database, and raises fix pull requests with the minimum viable upgrade path.
Socket
Analyzes what a package actually does, including install scripts, network and filesystem access and obfuscated code, to catch supply chain attacks that advisory based scanners never see.
Sonatype
Commercial software composition analysis that identifies components by binary fingerprint and enforces staged security and license policy across the build and release pipeline.