Dependency Management

What Is Software Composition Analysis (SCA)?

Software Composition Analysis (SCA) is a category of tools that identify open-source components and known vulnerabilities in software by analyzing source code and declared package manifests during development.

SCA is foundational for AppSec workflows and is referenced in standards like ISO 27001 and DORA. But SCA has structural limits: it requires source code, it depends on accurate dependency declarations, and it does not inspect what the compiler or build system actually produced. In environments where source is unavailable — third-party firmware, acquired binaries, vendor appliances, legacy software — SCA cannot operate.

Binary composition analysis complements SCA by working directly on the compiled artifact, with no source code or vendor cooperation required.

Related Terms

Binary Composition Analysis · Software Bill of Materials · Open Source Software · Transitive Dependency