AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

3 tools match

Active Reachability Analysis Clear all

  • Endor Labs

    Endor Labs

    SCA

    A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.

    Commercial
    Growing

  • Mend

    Mend.io

    SCA

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial
    Established

  • Qwiet AI

    Qwiet AI

    SCA

    Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.

    Commercial
    Growing

  • Endor Labs

    Endor Labs

    A composition analysis platform that builds call graphs across application and dependency code to determine whether a vulnerable function is actually reachable before raising it.

    Commercial Growing
    SCA

  • Mend

    Mend.io

    A composition analysis platform combining broad ecosystem coverage, license policy and automated upgrade pull requests, with reachability analysis to prioritize what matters.

    Commercial Established
    SCA

  • Qwiet AI

    Qwiet AI

    Builds a code property graph of the application and its dependencies, then uses data flow across that graph to judge whether a vulnerable library function is actually reachable.

    Commercial Growing
    SCA
Tick up to 4 tools above.