SCA (Software Composition Analysis)
SCA (Software Composition Analysis) is a method that inventories the open-source and third-party components in a codebase and matches them against known-vulnerability databases like the NVD and license data, flagging risky or non-compliant dependencies developers rely on.
Modern applications are built mostly from open-source libraries, so much of the attack surface lives in code the team did not write. SCA addresses this by identifying every direct and transitive dependency, typically by reading manifest and lockfiles (such as package-lock.json, pom.xml, or requirements.txt), and building a complete component inventory.
SCA then cross-references each component and version against vulnerability sources like the NVD and public advisory feeds to find known CVEs, and often checks the component's license for legal or policy compliance. Results include the affected package, the vulnerable version range, and usually a recommended fixed version. The inventory it produces can also feed an SBOM.
For developers, SCA answers a question SAST cannot: are the libraries I depend on safe and up to date? Because it works from published advisories, its accuracy depends on precise version resolution, including transitive dependencies and version ranges, so that upgrade guidance is trustworthy.