Software Composition Analysis (SCA)
Also Known As
TL;DR
Explanation
SCA tools parse manifests (composer.lock, package-lock.json, go.sum, requirements.txt, Cargo.lock), resolve the full transitive dependency tree, and cross-reference every package + version against vulnerability databases such as the National Vulnerability Database, GitHub Advisory Database, OSV.dev, and Snyk's own feed. Output typically includes: direct vs transitive hit, severity (CVSS), fix-available version, and licence compatibility with your project's licence. Popular tools include Dependabot, Snyk, GitHub's built-in advisories, OWASP Dependency-Check, Grype, and Trivy. SCA differs from SAST (which analyses your own source code for bugs) and DAST (which tests running applications) — it is concerned only with the components you pulled in. Modern supply-chain-attack awareness (SolarWinds, xz-utils, Log4Shell) made SCA a mandatory part of any security programme.
Common Misconception
Why It Matters
Common Mistakes
- Scanning only direct dependencies — transitive dependencies are often the ones with critical CVEs; make sure your tool resolves the full tree.
- Ignoring 'low' severity findings forever — low + widespread + in a signing library can be more dangerous than a 'critical' in an obscure dev-only package.
- Not scanning lock files — scanning a range spec like ^1.2.0 finds hypothetical vulnerabilities; scan the lock file for what is actually installed.
- Treating SCA as a gate without triage — flooding pull requests with findings burns out the team and everything gets marked 'won't fix'; tune thresholds and require context in the ticket.
- Forgetting the licence axis — SCA also flags GPL or AGPL pulled into a commercial proprietary product; that risk can be bigger than the CVE list.
Avoid When
- A trivial internal tool with zero external dependencies and no user input — the signal-to-noise is low.
When To Use
- Any project shipping to production — run SCA in CI on every pull request.
- Compliance audits — SOC 2 / ISO 27001 / PCI-DSS increasingly expect continuous component scanning.
- Before accepting a new major-version upgrade — run SCA against the new lock file first.