AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

3 tools match

Active Artifactory Clear all

  • Black Duck

    Black Duck Software

    SCA

    A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.

    Commercial
    Established

  • JFrog Xray

    JFrog

    SCA

    A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.

    Commercial
    Established

  • Mend

    Mend.io

    SCA

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial
    Established

  • Black Duck

    Black Duck Software

    A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.

    Commercial Established
    SCA

  • JFrog Xray

    JFrog

    A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.

    Commercial Established
    SCA

  • Mend

    Mend.io

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial Established
    SCA
Tick up to 4 tools above.