SCA (Software Composition Analysis)

SCA identifies open-source components in codebases and detects known vulnerabilities and license risks.

What is SCA?

Software Composition Analysis (SCA) automatically identifies open-source software in a codebase, providing visibility into component versions, vulnerabilities, and license compliance risks.

SCA Capabilities

Dependency identification, Vulnerability detection, License compliance, SBOM generation.

Common Misconceptions

"SCA is just dependency checking" - Includes license and risk
"Direct dependencies only" - Transitive dependencies matter
"Low vulnerabilities are ignorable" - Context determines risk