Home / Knowledge hub / Software composition analysis
Knowledge hub
Software composition analysis
Inventorying your open-source parts and flagging the ones with known flaws.
What it means
Software composition analysis, or SCA, lists the open-source and third-party components in your application, including the ones your dependencies pull in, and checks each version against databases of known vulnerabilities and licence terms. It reads manifests and lockfiles, and sometimes the built code.
Most modern applications are mostly other people's code. A team writes a small part and installs the rest. SCA answers a plain question: of everything we ship, what has a published flaw? It does not examine your own code, which is the job of other tools.
Why it matters
A single vulnerable library can expose every app that uses it, and attackers watch for new advisories and scan for them within days. Knowing what you ship is what lets you respond when a flaw is announced. Without a list, teams spend the first day, the most valuable one, just finding out which applications are affected.
Customers and regulators now ask for it, often alongside an SBOM. It also feeds patch management. The catch is noise: many flagged flaws sit in code your app never calls, so results need ranking before anyone is asked to fix them. A list of four hundred findings gets ignored; a list of ten that matter gets done.
How it shows up
You meet it in the pull request, the build pipeline and the repository. The repeated problems are scanning only direct dependencies and missing transitive ones, a report nobody reads, and findings marked critical regardless of whether the vulnerable function is used. Teams then ignore the tool.
Scan on every change and on a schedule, include transitive dependencies, and use a lockfile so the scan matches what ships. Rank by exploitability and reachability, then fix by upgrading or replacing. A known-vulnerable component that can be reached from the internet should come first.
Questions people ask
Software composition analysis, answered
What is the difference between SCA and SAST?
SCA checks the third-party components you use against known vulnerabilities. SAST analyses the code you wrote for weaknesses. They find different kinds of problems, they do not overlap much, and most teams use both together.
What is a transitive dependency?
It is a package your dependency depends on, not one you chose yourself. Most vulnerable components arrive this way, so a scan that only reads your direct list misses much of what you ship.
Why does SCA report so many findings?
Because a component may carry a published flaw in a function your code never uses. The tool matches versions, not behaviour. Reachability analysis and testing the running app show which findings can be exploited.
Is SCA the same as an SBOM?
No. An SBOM is an inventory of components. SCA uses an inventory to look for known vulnerabilities and licence issues. They work together, since SCA can read or produce an SBOM.
Where do the vulnerability databases come from?
Common sources include the National Vulnerability Database, the GitHub Advisory Database and OSV. Tools combine them, and coverage differs between ecosystems and languages, so any single source can miss things that another one lists.
Related
Terms that sit next to this one
SBOM
A list of every component your application includes, with versions.
Transitive dependency
A library pulled in by another library you chose, which you still ship.
Dependency vulnerability
A known flaw in a library your application ships.
SAST
Tools that read your source code without ever running it.
Lockfile
A file pinning exact dependency versions so builds are repeatable and checkable.
Which flagged flaw can be reached?
SCA lists what is known to be vulnerable. We test whether a flaw can be exploited in your running app and report only what we proved, so you can fix the real ones first. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.