Contrast SCA

Contrast SCA uses instrumentation to automatically catalogue third-party software risk across the software supply chain. By embedding into native CI/CD workflows, Contrast SCA automatically catalogues and maps open source and other third-party components into a comprehensive bill-of-materials to give Security teams full visibility into vulnerable libraries and risky open source licenses - no scanning required. Because the software supply chain can introduce layers of compounding risk through dependencies, Contrast SCA will flag dependencies for security vulnerabilities and pinpoint potential for targeted supply chain attacks like dependency confusion. Because it operates in the runtime, Contrast SCA is able to help Security and Development teams prioritize remediation efforts by flagging libraries that are actively used by the application.