AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals

28 tools

  • Anchore

    Anchore

    SCA

    An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

    Open source and commercial
    Established

  • Anchore Grype

    Anchore

    SCA

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source
    Established

  • Arnica

    Arnica

    SCA

    A source-control-native application security platform that scans dependencies, secrets and code changes on push and pushes findings to the committing developer in chat.

    Freemium
    Growing

  • Black Duck

    Black Duck Software

    SCA

    A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.

    Commercial
    Established

  • CAST Highlight

    CAST

    SCA

    A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.

    Commercial
    Established

  • cdxgen

    CycloneDX

    SCA

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source
    Established

  • Chainguard

    Chainguard

    SCA

    A supplier of minimal, continuously rebuilt container images and language dependencies that ship with signatures, provenance and SBOMs to cut vulnerability backlog at the source.

    Commercial, free tier
    Growing

  • Crash Override

    Crash Override

    SCA

    A supply chain platform built around build-time artifact marking, linking running workloads back to the source code, pipeline and people that produced them.

    Commercial
    Emerging

  • Endor Labs

    Endor Labs

    SCA

    A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.

    Commercial
    Growing

  • Finite State

    Finite State

    SCA

    A product security platform that unpacks firmware and binaries to generate SBOMs and identify component vulnerabilities in connected devices where no source code is available.

    Commercial
    Growing

  • FOSSA

    FOSSA

    SCA

    A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.

    Freemium
    Established

  • GitHub Dependabot

    GitHub

    SCA

    GitHub's built-in dependency scanner and update bot, matching your dependency graph against the GitHub Advisory Database and opening pull requests that bump vulnerable packages.

    Free
    Established

  • Anchore

    Anchore

    An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

    Open source and commercial Established
    SCA

  • Anchore Grype

    Anchore

    An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

    Open source Established
    SCA

  • Arnica

    Arnica

    A source-control-native application security platform that scans dependencies, secrets and code changes on push and pushes findings to the committing developer in chat.

    Freemium Growing
    SCA

  • Black Duck

    Black Duck Software

    A software composition analysis platform that identifies open source components through manifest parsing, file signature matching and binary analysis, with deep license obligation data.

    Commercial Established
    SCA

  • CAST Highlight

    CAST

    A rapid portfolio scanner that analyzes source across hundreds of applications to report open source component risk, license exposure, cloud readiness and software health.

    Commercial Established
    SCA

  • cdxgen

    CycloneDX

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source Established
    SCA

  • Chainguard

    Chainguard

    A supplier of minimal, continuously rebuilt container images and language dependencies that ship with signatures, provenance and SBOMs to cut vulnerability backlog at the source.

    Commercial, free tier Growing
    SCA

  • Crash Override

    Crash Override

    A supply chain platform built around build-time artifact marking, linking running workloads back to the source code, pipeline and people that produced them.

    Commercial Emerging
    SCA

  • Endor Labs

    Endor Labs

    A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.

    Commercial Growing
    SCA

  • Finite State

    Finite State

    A product security platform that unpacks firmware and binaries to generate SBOMs and identify component vulnerabilities in connected devices where no source code is available.

    Commercial Growing
    SCA

  • FOSSA

    FOSSA

    A composition analysis platform focused on license obligation management, resolving dependencies through native build tooling and generating attribution notices and SBOMs.

    Freemium Established
    SCA

  • GitHub Dependabot

    GitHub

    GitHub's built-in dependency scanner and update bot, matching your dependency graph against the GitHub Advisory Database and opening pull requests that bump vulnerable packages.

    Free Established
    SCA

  • JFrog Xray

    JFrog

    SCA

    A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.

    Commercial
    Established

  • Mend

    Mend.io

    SCA

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial
    Established

  • OpenText Core SCA (Debricked)

    OpenText

    SCA

    A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.

    Freemium
    Established

  • OSV-Scanner

    Google

    SCA

    Command line scanner that matches lockfiles, SBOMs and container contents against the OSV.dev advisory database using precise affected version ranges.

    Open source
    Growing

  • OWASP Dependency-Check

    OWASP

    SCA

    Long running OWASP project that identifies dependencies by collecting evidence from artifacts, maps them to CPE identifiers, and reports matching CVEs from the National Vulnerability Database.

    Open source
    Established

  • OWASP Dependency-Track

    OWASP

    SCA

    A self-hosted platform that ingests CycloneDX SBOMs and continuously re-evaluates every component against vulnerability and policy data, without rescanning the source.

    Open source
    Established

  • Qwiet AI

    Qwiet AI

    SCA

    Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.

    Commercial
    Growing

  • Renovate

    Mend

    SCA

    Dependency update bot that detects outdated packages across dozens of package managers and raises pull requests to bump them, with grouping, scheduling and automerge rules.

    Open source
    Established

  • Retire.js

    Retire.js Project

    SCA

    Scanner that identifies outdated JavaScript libraries by content hash, filename pattern and code signature, including in bundled and minified files where no manifest exists.

    Open source
    Established

  • Revenera FlexNet Code Insight

    Revenera

    SCA

    Compliance oriented composition analysis that combines dependency scanning with source snippet matching against a large open source knowledge base, wrapped in a legal review workflow.

    Commercial
    Established

  • SCANOSS

    SCANOSS

    SCA

    Open source composition analysis engine that fingerprints code at snippet level using winnowing hashes and matches it against a knowledge base you can query as a service or host yourself.

    Freemium
    Growing

  • Seal Security

    Seal Security

    SCA

    Supplies security backports for vulnerable open source packages so a fix can be applied on the version you already run, avoiding the breaking upgrade path.

    Commercial
    Emerging

  • JFrog Xray

    JFrog

    A composition analysis engine layered on JFrog Artifactory that recursively indexes stored artifacts and enforces security and license policy at download and promotion points.

    Commercial Established
    SCA

  • Mend

    Mend.io

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial Established
    SCA

  • OpenText Core SCA (Debricked)

    OpenText

    A composition analysis service that resolves dependency trees from source, matches known vulnerabilities, and scores the health and maintenance risk of the projects you depend on.

    Freemium Established
    SCA

  • OSV-Scanner

    Google

    Command line scanner that matches lockfiles, SBOMs and container contents against the OSV.dev advisory database using precise affected version ranges.

    Open source Growing
    SCA

  • OWASP Dependency-Check

    OWASP

    Long running OWASP project that identifies dependencies by collecting evidence from artifacts, maps them to CPE identifiers, and reports matching CVEs from the National Vulnerability Database.

    Open source Established
    SCA

  • OWASP Dependency-Track

    OWASP

    A self-hosted platform that ingests CycloneDX SBOMs and continuously re-evaluates every component against vulnerability and policy data, without rescanning the source.

    Open source Established
    SCA

  • Qwiet AI

    Qwiet AI

    Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.

    Commercial Growing
    SCA

  • Renovate

    Mend

    Dependency update bot that detects outdated packages across dozens of package managers and raises pull requests to bump them, with grouping, scheduling and automerge rules.

    Open source Established
    SCA

  • Retire.js

    Retire.js Project

    Scanner that identifies outdated JavaScript libraries by content hash, filename pattern and code signature, including in bundled and minified files where no manifest exists.

    Open source Established
    SCA

  • Revenera FlexNet Code Insight

    Revenera

    Compliance oriented composition analysis that combines dependency scanning with source snippet matching against a large open source knowledge base, wrapped in a legal review workflow.

    Commercial Established
    SCA

  • SCANOSS

    SCANOSS

    Open source composition analysis engine that fingerprints code at snippet level using winnowing hashes and matches it against a knowledge base you can query as a service or host yourself.

    Freemium Growing
    SCA

  • Seal Security

    Seal Security

    Supplies security backports for vulnerable open source packages so a fix can be applied on the version you already run, avoiding the breaking upgrade path.

    Commercial Emerging
    SCA
Tick up to 4 tools above.