Software Composition Analysis (SCA)
Software Composition Analysis (SCA) is the practice of identifying the open source and third-party components in a codebase and analyzing them for known vulnerabilities, license obligations, and supply chain risks.
Software Composition Analysis, or SCA, is a security discipline focused on the components a project depends on rather than the code developers write themselves. Because modern applications are largely assembled from open source libraries, SCA inventories those direct and transitive dependencies and evaluates the risk each one carries.
An SCA tool resolves the full dependency tree, often generating a software bill of materials (SBOM), and matches each component and version against vulnerability databases such as public advisories and the National Vulnerability Database. It flags known vulnerabilities (typically referenced by CVE), surfaces license information for compliance, and can detect outdated or risky components, including indicators of malicious packages.
For developers, SCA is essential because a single vulnerable or non-compliant dependency, sometimes buried several layers deep, can expose an entire application. Running it continuously in the pipeline keeps dependency risk visible as libraries update and new vulnerabilities are disclosed, and it pairs naturally with reachability and risk-prioritization approaches that help teams fix the issues that actually matter first.