What Is Software Composition Analysis?
Software composition analysis (SCA) identifies the open source and third-party components in an application, including transitive dependencies, and flags those with known vulnerabilities, license problems or signs of abandonment.
Also known as:
How SCA Works
An SCA tool reads manifests and lockfiles, such as package-lock.json, requirements.txt or go.sum, and sometimes inspects built artifacts or container images. It builds a list of every component and version, then matches that list against vulnerability databases and license data. Many tools can export the result as a software bill of materials (SBOM).
What SCA Finds
- Known vulnerabilities. Components with published CVEs or advisories.
- Transitive risk. Vulnerable packages pulled in by your dependencies, not just the ones you chose.
- License issues. Licenses that conflict with how the software is distributed.
- Outdated or abandoned packages. Components that no longer receive fixes.
Why SCA Is So Noisy
Modern applications include hundreds or thousands of dependencies, and SCA reports every known vulnerability in every one of them. Most of those vulnerable functions are never called by the application. Without reachability analysis, teams spend time upgrading packages that posed no real risk while genuinely exploitable issues wait in the same queue.
SCA and Supply Chain Attacks
Classic SCA matches against known vulnerabilities, so it has nothing to flag when a malicious package version is published before any CVE exists. Defenses against supply chain attacks, such as dependency cooldowns and reviewing new packages, complement SCA rather than coming from it.
How Nullify Handles Dependency Risk
Nullify brings supply chain risks into one prioritized backlog alongside code, secrets, cloud and pentest findings, scores them on severity, exploitability, reachability and business impact, and can run campaigns such as upgrading CVE-affected dependencies across many repositories. See how Nullify runs dependency campaigns.
Key Takeaways
- SCA inventories open source dependencies and flags known vulnerabilities and license issues.
- Transitive dependencies are where much of the risk hides.
- Without reachability, most SCA findings are noise.
- SCA does not catch malicious packages that have no CVE yet.
Read More About Software Composition Analysis
Program Management
See Nullify in Action
Nullify turns dependency findings into prioritized, tracked upgrade campaigns.