Software Composition Analysis (SCA) Tools

Aikido provides everything the average startup to mid-market company needs for security in a box - every code and cloud security scanner under the sun without much feature compromise, alongside a surprisingly robust runtime application solution for things like bot prevention. A no-nonsense replacement for a lot of more "specialized" solutions that tend to slow developers down.

Endor Labs stands out in their granularity and reachability analysis for open source packages. They've also added back ported patches and automatic fix suggestions based on function changes between patch versions. They offer basic SAST capabilities via opengrep for companies that need it.

Konvu provides robust AI prioritization and autofixing, currently for SCA vulnerabilities but expanding to others as well. These are some of the strongest prioritization and fixing capabilities I've seen within the SCA category, and it's a great help for teams struggling to burn down their backlog.

Seal backports security patches for open source libraries and container images, allowing you to auto-patch any vulnerabilities without doing major framework updates.

Fossa has really focused on SCA and SBOM for the enterprise. They have mature SBOM offerings such as a sharing portal, evolving reachability capabilities, internal dependency tracking, and good quality insights on repos.

Grit provides pre-baked playbooks for everything from framework migrations to major security patches. The most time consuming part of patching is figuring out the changes, and Grit does that part for you, even updating tests. Them and Moderne are providing amazing value for actually getting things patched. Grit uses GenAI to help create playbooks for major upgrades.

GitGuardian is the best paid provider for this tool and is a great solution for deploying secret detection at scale. On the one hand, secret scanning is a very narrow function, but on the other, a leak is extremely costly. While Arnica does the workflow, GitGuardian has more robust detection.

Infield offers both a product and services for handling complex migration efforts for common application upgrades. They have a robust history of success and combining the service with the SaaS should be appealing to customers who don't find the product value in upgrades.

Coana built an SCA with direct and transitive dependency detection that is now a part of Socket. They also have advanced function level reachability analysis.