Software Composition Analysis (SCA) Tools

Sonatype secures the software supply chain and protects organizations' vital software development lifecycle(SDLC). The platform unites security teams and developers…

Veracode is a software security firm that identifies flaws and vulnerabilities across the software development lifecycle. Veracode’s Software Security Platform uses advanced AI algorithms trained on vast datasets of code, for more precise identification and rectification of security…

BluBracket is an enterprise security solution for code in a software-driven world. BluBracket gives companies visibility into where source code introduces security risk while also enabling them to fully secure their code without altering developer workflows or productivity.

Snyk’s Developer Security Platform automatically integrates with a developer’s workflow and helps security teams to collaborate with their development teams. It boasts a developer-first approach that ensures organizations can secure all of the critical components of their applications from code to cloud, driving dev…

IDA Pro as a disassembler is capable of creating maps of their execution to show the binary instructions that are…

Through a subscription, Tidelift, headquartered in Boston, aims to deliver a comprehensive management solution, including the tools to create customizable catalogs of known-good, proactively maintained components backed by Tidelift and its open source maintainer partners.

CAST headquartered in New York offers Highlight, an application portfolio management solution providing software component analysis , application security, application benchmarking, and technical due diligence.

CodeLogic provides comprehensive insights into software dependencies to helpJava, .Net, and JavaScript developers to assess downstream impacts of code and database changes and proactively identify potential issues. Benefits include:

• Visualizing the dependency impact of each pull req…

Sonatype Vulnerability Scanner (formerly DepShield) discovers vulnerability among open source components and code in an application. It is available free and open source.

JFrog Security Essentials / Xray SCA can be used to discover and eliminate unwanted or unexpected packages, using JFrog’s database of identified malicious packages. It is presented as a DevOps-centric SCA solution for identifying and resolving security vulnerabilities and license…

SOOS is a Software Composition Analysis and Dynamic Application Security Testing solution from the company of the same name in Winooski, Vermont. Users can scan open source software for vulnerabilities, control the introduction of new dependencies, exclude unwanted license-types,…

Debricked's tool enables increased use of Open Source while aiming to keep vulnerabilities and non compliant licenses at bay, making it possible to keep a high development speed while still staying secure. The vendor states the service runs on machine learning, all…

Software Composition Analysis (SCA)

FossID Workbench…

Contrast SCA delivers automated open source risk management by embedding security and compliance checks in applications throughout the development process while performing continuous monitoring in production. The vendor states Contrast SCA can identify vulnerable components, determine…

Apiiro is a Cloud Application Security Platform that empowers security and development teams with complete visibility and actionable context to proactively remediate critical risks in modern applications and software supply chains. Apiiro uses static code, binary, and text analysis…

Black Duck is a software composition analysis tool acquired and now supported by Synopsys since 2017.

Prisma Cloud, from Palo Alto Networks (based on technology acquired with Evident.io, or the Evident Security Platform) is presented as a comprehensive Cloud Native Security Platform (CNSP) that delivers full lifecycle security and full stack protection for multi- and hybrid-cloud…

Lacework is a cloud-native application protection platform offered as-a-Service; delivering build-time to run-time threat detection, behavioral anomaly detection, and cloud compliance across multicloud environments, workloads, containers, and Kubernetes.

Mend SCA (formerly WhiteSource) is a solution for agile open source security and license compliance management. Mend SCA integrates with the DevOps pipeline to detect vulnerable open source libraries in real-time.

It provides remediation paths and policy automation to speed up time-to-fix. It also pr…

AppScan (formerly Rational AppScan) is an application security testing solution acquired by HCL Technologies from IBM in late 2018. Appscan supports both dynamic (DAST) and static (SAST) application security testing.

CloudDefense.AI's platform offers a unified understanding of risks in code, cloud and dark web. Building this unified attack graph leads to noise reduction, to stay ahead of cyber threats. The Comprehensive Suite - From Code-to-Cloud-to-Recon includes:

• Static Application Security…

DerScanner is a…