Shortlisting SCA vendors? See how Endor Labs stacks up: Endor Labs SCA and Endor Labs Software Supply Chain Security, main features, target customers and top competitors.
DevSecOps & Software Supply Chain
SCA Tools: Software Composition Analysis for Open Source
Most apps are built on open-source code. Compare software composition analysis (SCA) tools for vulnerable dependency detection, license risk, SBOMs and auto-fixes.
18 vendors33 products
See the Top 18 rankingSCA vendors 18
Companies that offer SCA.
Featured vendors
Considering Snyk? Review Snyk Container, Snyk IaC and Snyk SBOM, core Container Security features, ideal customers and the strongest alternatives in one place.
These vendors are highlighted by Cyber Rank. This does not affect our rankings, reviews or the order of the list below.
Aikido Security
San Francisco, California, USA
Apiiro
New York, New York, USA
Black Duck
Burlington, Massachusetts, USA
Chainguard
Kirkland, Washington, USA
Checkmarx
Tel Aviv, Israel
Cycode
Tel Aviv, Israel
Endor Labs
Palo Alto, California, USA
GitHub
San Francisco, California, USA
GitLab
San Francisco, California, USA
HCLSoftware
Noida, India
JFrog
Sunnyvale, California, USA
Mend
Boston, Massachusetts, USA
OWASP
Global nonprofit organization
OpenText
Waterloo, Ontario, Canada
Semgrep
San Francisco, California, USA
Snyk
Boston, Massachusetts, USA
Sonatype
Fulton, Maryland, USA
Veracode
Burlington, Massachusetts, USA
SCA products 33
Open a product to see its features, pricing and reviews, or compare it with others.
Aikido Security
Aikido Security is an all-in-one developer-first application security platform for developer application security. See features and Application Security alternatives.
Application SecurityView details
Apiiro SCA
byApiiro
Try Apiiro SCA free: a software composition analysis with SBOM generation and license risk analysis. See who it suits and how it stacks up against other SCA tools.
DevSecOps & Software Supply ChainView details
Black Duck CodeSight
Black Duck CodeSight delivers secret detection for real-time in-editor security scanning. Explore its SCA capabilities, deployment choices and top competitors.
Application SecurityView details
Black Duck SCA
Black Duck SCA covers open-source vulnerability management, license compliance auditing and automated SBOM generation for SCA dependency scanning. Compare top SCA tools.
Application SecurityView details
Black Duck SCA Complete
Looking for SCA software? Black Duck SCA Complete by Black Duck provides copyright audit and deep binary analysis for binary auditing. Compare features and alternatives.
DevSecOps & Software Supply ChainView details
Black Duck Software Composition Analysis
Black Duck Software Composition Analysis delivers CVE prioritization for SBOM creation. Explore its SCA capabilities, deployment choices and top competitors.
DevSecOps & Software Supply ChainView details
Chainguard Libraries
Chainguard Libraries: SBOM attestations and reproducible builds. Built for open-source dependency management. Compare Software Supply Chain Security alternatives.
DevSecOps & Software Supply ChainView details
Checkmarx One
Free trial available. Checkmarx One by Checkmarx offers SAST, SCA, DAST, API security, IaC. Compare features, use cases and leading Application Security alternatives.
Application SecurityView details
Checkmarx SCA
Checkmarx SCA from Checkmarx focuses on Dependency Security. Key capabilities: SBOM creation and license risk governance. Compare it with the leading SCA alternatives.
DevSecOps & Software Supply ChainView details
Cycode SCA
byCycode
Try Cycode SCA free: a software composition analysis & supply chain shield with SBOM generation. See who it suits and how it stacks up against other SCA tools.
DevSecOps & Software Supply ChainView details
Endor Labs
Endor Labs: function call-path reachability and 80% vulnerability noise reduction. Built for reachability-based SCA. Compare Software Supply Chain Security alternatives.
Application SecurityView details
Endor Labs Dependency Lifecycle Management
Endor Labs Dependency Lifecycle Management: package health scoring. Built for open-source package selection. Compare Software Supply Chain Security alternatives.
DevSecOps & Software Supply ChainView details
Endor Labs SCA
Endor Labs built Endor Labs SCA for software composition analysis. Explore PR gating and SPDX/CycloneDX SBOMs, review cloud deployment and compare similar SCA products.
DevSecOps & Software Supply ChainView details
Endor Labs Software Supply Chain Security
Endor Labs Software Supply Chain Security: reachable SCA and policy enforcement. Built for build pipeline defense. Compare Software Supply Chain Security alternatives.
DevSecOps & Software Supply ChainView details
GitHub Advanced Security
byGitHub
GitHub Advanced Security: custom query creation and automated pull requests. Built for static application security testing. Compare Application Security alternatives.
Application SecurityView details
GitLab Application Security Testing
byGitLab
GitLab Application Security Testing by GitLab: SAST. Ideal for Code Security. Deployment: cloud. See how it compares with top Application Security Testing alternatives.
Application SecurityView details
GitLab DevSecOps
byGitLab
See what GitLab DevSecOps offers: SBOM generation. It is built for Software Supply Chain, supports cloud deployment and competes with other DevSecOps tools.
Application SecurityView details
HCL AppScan Standard
Looking for SCA software? HCL AppScan Standard by HCLSoftware provides compliance reports for black-box vulnerability assessment. Compare features and alternatives.
Application SecurityView details
JFrog Curation
byJFrog
What does JFrog Curation do? It covers license rules and malicious package blocking. See typical use cases, cloud deployment and how it compares to rivals.
DevSecOps & Software Supply ChainView details
JFrog Xray
byJFrog
JFrog Xray from JFrog focuses on Vulnerability Scan. Key capabilities: component graphs and automated SBOM generation. Compare it with the leading SCA alternatives.
DevSecOps & Software Supply ChainView details
Mend Renovate
byMend
Get the facts on Mend Renovate: semantic versioning. Built for Dependency Updates. Compare it with other Software Supply Chain Security options before you decide.
DevSecOps & Software Supply ChainView details
Mend SBOM
byMend
Free trial available. Mend SBOM by Mend offers CycloneDX & SPDX export and component vulnerability tracking. Compare features, use cases and leading SBOM alternatives.
DevSecOps & Software Supply ChainView details
Mend SCA
byMend
Mend SCA, from Mend, provides license risk governance and automated dependency updates. Common uses: License Compliance. Check deployment options and top SCA competitors.
DevSecOps & Software Supply ChainView details
Mend.io Platform
byMend
Mend.io Platform covers unified application & supply chain security and SAST, SCA, secrets, container for DevSecOps. Compare top Application Security tools.
Application SecurityView details
Showing page 1 of 2 (33 products)
← PreviousNext →