Software Composition Analysis (SCA) Tools

Acquired by Google. Wiz is the leader in having an all-in-one cloud security platform by expanding into CTEM, ASPM, and Runtime capabilities all within a single dashboard. Their posture and vulnerability capabilities remain the strongest, but their Code and Defend offerings are competitive in their own right.

Oligo Security offers application layer insights as part of a CADR platform. They baseline application library activities at a function level, and can detect either malicious deviation, or the execution of known vulnerable functions. This extends into AI, allowing them to see, detect, and respond to AI applications.

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Cycode offers a holistic all-in-one ASPM tool with their in house scanners alongside the ability to import third party findings. They offer about every scanner and feature you could need out of an AppSec tool.

Depthfirst offers AI native application security functionality from threat modeling to scanning tools.

Backslash offers a unique approach to reachability across SCA and SAST, as well as a suite of vibe-coding security features such as MCP risk assessments and cursor rules.

Raven has built a comprehensive runtime oriented ADR solution that can detect function executions from packages being exploited. This empowers them to detect application layer attacks, create prioritization based on what functions are being used, as well as virtual patching to prevent vulnerability exploitation.

Kodem offers runtime first code security solutions - from runtime function execution SCA to runtime detection for prioritizing SAST findings. They're also one of the few to offer ADR solutions.

Apiiro has built an all-in-one application security management solution that is especially strong at managing application security results at enterprise scale. They focus on building robust relationships between code assets to manage application security programs at scale.

Corgea provides a robust bundling of AI first scanning tools - from AI SAST to SCA and Secrets scanning. Corgea's especially strong at discovering vulnerabilities via AI scanning, and AI based prioritization for false positive analysis.

An AI-native application security platform that unifies various scanning and enforcement tools, identifies real vulnerabilities, reduces false positives, and generates contextual fixes integrated into developer workflows.

Endor Labs stands out in their granularity and reachability analysis for open source packages. They've also added back ported patches and automatic fix suggestions based on function changes between patch versions. They offer basic SAST capabilities via opengrep for companies that need it.

Ox provides an all-in-one application security solution that provides their own scanners combined with the ability to import third party findings. They also have a robust API for managing the data in the tool.

Orca offers the standard suite of CNAPP features with a focus on agentless scanning. They're a good all around CNAPP offering mostly focused on the posture side.

Socket has great malware detection capabilities as part of their SCA solution, alongside function reachability from their acquisition of Coana. They have especially robust support within the JavaScript ecosystem.

Checkmarx has adapted well to the DevSecOps model, offering a lighter weight scanner in the Checkmarx One platform, that integrates well into the larger stack. They don't have all the latest features of some newer companies, but they certainly get the job done for diverse enterprises. I would not suggest venturing off Checkmarx One though.

Legit Security offers a holistic ASPM platform that focuses more on pipeline discovery, security, and third party data ingestion than native scanning solutions.

Via their oneagent, Dynatrace provides highly competitive ADR capabilities with function level reachability, RASP style blocking, and the ability to query most logs. Their agent also extends into processes and hosts. Their CADR offering has the complete offering from a feature perspective, but the UX struggles to tie it together for security.

Arnica is a holistic application security solution that focuses primarily on providing a strong developer experience. They have robust policy and attribution engines to build detail oriented workflows getting the right finding to the right person at the right time.

Of all the companies in this space, Tidelift is the only one I could describe as uniquely ethical. If you're tired of shoveling your CVE scanner results into open source backlogs, never to be fixed, working with Tidelift allows you to actually work with maintainers to get your issues fixed upstream - while checking the box on standard SCA feature sets (plus a few unique package health assessments).

Snyk was the first to really do DevSecOps - fast, actionable, developer focused CI/CD security scanning. They also were early to consolidate scanners into a single place - IaC, Code, SCA, and Container. There are many platforms with small improvements over them - better reachability, workflows, etc. - but they remain a strong player in the space for having scaled so meaningfully across enterprises.

Paraxial provides a unique combination of security tooling specializing in the Elixir language and Phoenix framework. They're a great choice for companies that use Elixir, and have unique runtime elements that them stand out from open source options.

Soos offers holistic ASPM scanners and ingestion, with a special focus on in depth SCA scanning and SBOM generation

Miggo is maximizing the value of your existing application performance monitoring, or offers an instrumentation of their own, that excels at building maps of distributed systems and real time attack detection and prevention. Miggo has no-code as well integration based implementations.

Maze uses agentic AI to find the exploitability of vulnerabilities in cloud environments, increasing the risk score for true positives, while giving demonstrable proof when false positives cannot be exploited.

Acquired by Palo Alto Networks. Koi offers full inventories and workflows for managing packages, extensions, AI tools, containers and other components that users and developers pull from public marketplaces and registries that MDM and EDR tools rarely see. Koi scores risk per and enforces policy with an agentless approach so even exempt developer machines stay governed.

Konvu provides robust AI prioritization and autofixing, currently for SCA vulnerabilities but expanding to others as well. These are some of the strongest prioritization and fixing capabilities I've seen within the SCA category, and it's a great help for teams struggling to burn down their backlog.

Aqua Security built a lot of the open source projects that power modern cloud security, and can go feature for feature with most other CNAPP platforms. The downside of the CNAPP has been the UI/UX, and the focus has always been on container protection more than holistic cloud security features.

Cortex Cloud is a security operations platform that integrates cloud and application security capabilities into their larger security operations offerings. This provides a single hub for managing first and third party findings across vulnerabilities and runtime events.

Seal backports security patches for open source libraries and container images, allowing you to auto-patch any vulnerabilities without doing major framework updates.

Unfortunately, Myrror closed down, we have a podcast episode with one of the founders to learn more about that process. Myrror providds the standard suite of SCA tools with functional level reachability, but they had a much more unique technology that allows you to confirm that a binary was built from a particular source code. This allows the most thorough validation of supply chain assets I've seen and is an awesome functionality to ensuring you're not deploying unknown risks to your customers.

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list.

Xygeni offers a robust ASPM solution for managing and scanning for vulnerabilities, and mapping component relationships in your software. They have strong coverage for looking for active attacks to your supply chain.

Netrise has created rich dependency analysis specializing in firmware on hardware devices like Cisco Switches. They also detect hard-coded credentials, and other vulnerabilities. They've expanded this technology into containers to provide in depth analysis.

Mend was Snyk's main competitor early for quick open source scanning in pipeline, but did not expand as quickly as Snyk into other areas. Their open source Renovate tool is great for keeping your in-house dependencies up to date, but their UI and scanning engine were more difficult to deploy, maintain, and navigate. However, due to Renovate they have unique visibility into the expected challenge of a version upgrade. They've recently expanded most heavily into MLBOM capabilities.

Boost Security has a shared vision for all in one configuration scanning out to runtime. They have smart kubernetes & Istio integrations for runtime context, alongside the standard suite of SCA, SDLC, SAST, IaC, Secrets, and Containers based on a combination of open source and in house built tools. I appreciate the openness of their rule set in their documentation.

Fossa has really focused on SCA and SBOM for the enterprise. They have mature SBOM offerings such as a sharing portal, evolving reachability capabilities, internal dependency tracking, and good quality insights on repos.

Grit provides pre-baked playbooks for everything from framework migrations to major security patches. The most time consuming part of patching is figuring out the changes, and Grit does that part for you, even updating tests. Them and Moderne are providing amazing value for actually getting things patched. Grit uses GenAI to help create playbooks for major upgrades.

DryRun provides a flexible platform for AI code analysis, covering custom and out of the box use cases for in depth code analysis.

Datadog offers a complete suite a security offerings that are a great fit for developer focused teams not looking for the most mature details in each area. They offer most scanning types, runtime detections, and a full SIEM, and you're probably already sending them your logs. It's a great runtime choice to meet developers where they work, but the UX is built primarily for developers.

JIT built a holistic ASPM scanning solution, and has sense heavily invested in AI workflows. They consolidate scanners and create workflows and prioritization for developers. The JIT scanner is unique in that it's a wrapper for other scanners that you run in your own pipelines - an approach with pros and cons.

GitGuardian is the best paid provider for this tool and is a great solution for deploying secret detection at scale. On the one hand, secret scanning is a very narrow function, but on the other, a leak is extremely costly. While Arnica does the workflow, GitGuardian has more robust detection.

Aisle provides AI native code security scanning covering SCA and SAST.

Kusari has built a fixing oriented SCA on top of robust SBOM capabilities via their contributions with GUAC and SLSA, which are well established frameworks for mapping open source dependencies.

Contrast wraps commonly exploited functions at runtime to detect and prevent application exploits, i.e. they scan the application once it's actually built and running for vulnerabilities, and preventing exploits. This makes Contrast a strong choice for enterprise application protection.

Sternum built some very cool IP around protecting IoT devices, preventing memory attacks to a degree that I haven't seen elsewhere. They've since brought that same technology to the cloud, and will continue to be an innovator here as they expand eBPF detection capabilities.

GitHub Advanced Security is okay. It checks a lot of scanning boxes - most importantly SCA with dependabot, secrets scanning, and SAST with CodeQL. The tools tends to be very noisy, requires management via GitHub which can be challenging, and tends to generate a lot of false positives leading to operational difficulty over time

Hopper provides SCA and container scanning with the full suite of features you'd expect from a modern SCA tool - function level reachability, legal compliance, prioritization, and more. Their function level reachability uses a unique methodology to reduce false positives.

Reversing Labs has very robust malware detection capabilities when picking apart binaries. They're expanding this binary analysis into also creating SBOMs and SCA results. Some platform strengths are supporting traditional Windows packages and having robust approval workflows for stringent enterprise support. I wouldn't say developer workflows or ease of integrations are as good as other tools.

Acquired by Gitlab, Oxeye was a complete ASPM scanner that emphasized runtime context and API discovery

Start Left brings SAST, SCA, Container, and IaC scanning in a single platform. They also have AI code remediation recommendations, and provide a docker image for running local scans.

FluidAttacks offers a combined SAST, SCA, and DAST alongside service offerings for pentesting and code review.

Apona provides a combination SCA, SAST, and DAST features. Something unique about their SCA is providing a function level fix if one is available to avoid the patch.

Codacy is a code quality and scanning toolbox similar to SonarQube for code scanning. They support many languages via open source scanning tools and have a developer focus.

SonaType was one of the first organizations doing SDLC tooling; however, until recently, they did not have a cloud platform. Their platform is still catching up to the intuitiveness of the SaaS competition, but their product checks all the boxes.

Infield offers both a product and services for handling complex migration efforts for common application upgrades. They have a robust history of success and combining the service with the SaaS should be appealing to customers who don't find the product value in upgrades.

Lineaje offers robust SCA scanning and attestation that can guarantee your dependencies map back to the source code that created them. A strong option for enterprise and governments that need the most in depth SBOMs.

Rezlion combines their own scanning at runtime with ingesting from other platforms to provide an exploitability prioritization view of container and SCA vulnerabilities. They focus on simple deployment into your environment to prioritize what packages and libraries are running.

Scribe has created a tool focused on SBOM management and software attestation as your application is being built.

Does Synopsys technically do everything you'd need from an ASPM? Yes. Would you ever want to use it? No. They've focused heavily into the semiconductor industry, and their ASPM is heavily patched together from various acquisitions.

Qwiet takes a unique approach to scanning that starts with a map of your application, and scans within that context. They have smart prioritization filters combined with the standard suite of SCA, container, SAST, Secrets, and IaC scanning. They don't offer "pipeline-less" scanning via webhooks if that's a requirement for you.

Veracode is a legacy SAST vendor that has done a good job expanding into other categories. They are a great choice for organizations using more legacy or waterfall type development methods, but still don't have an intuitive interface or workflows for modern dev teams.

GitLab relies entirely on open source tooling to do the actual scanning, and their reporting is hard to use. Only recommended for organizations that are already on Ultimate tier, and even then the results are very mixed.

Acquired and subsequently shutdown by Cisco. Deep Factor differentiates their SCA tool with deep runtime insights on the open source package and its state of being loaded or not in the application - a good way to prioritize fixing.

Rainforest combines all in one code vulnerable scanning with brand protection capabilities. They instrument via an on premise VM allowing you to scan everything in your own environment.

Coana built an SCA with direct and transitive dependency detection that is now a part of Socket. They also have advanced function level reachability analysis.

Acquired by Checkmarx. Phylum meets standard SCA scanning requirements, but differentiates with upstream malware detection. They have some smart features such as providing a CLI wrapper for NPM stalls to block attempted malware installation during development.

Black Duck SCA is the oldest in the space, and provides a product that technically checks all of the SCA boxes, but is not nearly as user friendly as other tools. They get the job done, but UI is targeted more at security than developers.

OSSPREY focuses on malware detection in open source repos

Trivy is an amazing open source container, SCA, and IaC scanner provided by the team at Aqua Security. This awesome scanner powers a lot of tools under the hoods and is a great resource for the community.