Software composition analysis
Identification of open-source and third-party components in software, with their known vulnerabilities and licences.
21 vendors · alphabetical
- AnchoreAnchore sells an SBOM-powered solution that enables continuous scanning of applications from cloud-native deployments to legacy on-prem installations for security and compliance issues.Privately held
- ApiiroApiiro offers Guardian Agent, which protects coding agents, prevents risk and AutoFixes backlogs, powered by the Apiiro Context Graph.Ownership not established
- ArnicaArnica sells software that consolidates risks across SCA, AI SAST, IaC, secrets, licenses and low-reputation packages within a development environment.Ownership not established
- Black DuckBlack Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA.Owned by Clearlake Capital Group and Francisco Partners since 2024 · primary category
- CheckmarxCheckmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE.Owned by Hellman & Friedman since 2020
- Endor LabsEndor Labs sells AURI, a security intelligence layer for AI coding agents.Privately held · primary category
- GitLabGitLab states that software teams and their agents plan, build, secure, and ship on one control plane.Public (Nasdaq Global Market: GTLB)
- InvictiInvicti sells an application security platform that combines DAST, SAST, SCA, IaC, Secrets, and Container testing in one platform.Ownership not established
- JFrogJFrog describes the inputs and outputs of a software release as including binaries, packages, AI/ML models, agent skills, MCP servers, and plugins.Public (Nasdaq: FROG)
- KiuwanKiuwan sells static application security testing (SAST) and software composition analysis (SCA).Owned by Idera, Inc. since 2018
- Mend.ioMend.io sells enterprise AI security and application security software, and secures the full chain from open source dependencies and AI models to container images.Ownership not established · primary category
- OligoOligo gives security teams real-time runtime intelligence across code, cloud, and AI.Privately held
- OX SecurityOX Security states a mission to create a world where software secures itself.Ownership not established
- Phoenix SecurityPhoenix Security is an Actionable ASPM platform that correlates vulnerabilities from code to cloud, turning fragmented findings into a single, prioritized remediation flow.Ownership not established
- RapidFortRapidFort sells a single platform that combines runtime visibility, secure image foundations, vulnerability analysis, automated hardening, and compliance validation.Ownership not established
- Raven.ioRaven.io sells runtime security that prevents exploits at runtime, before there is a CVE.Ownership not established
- SemgrepSemgrep sells an application security platform that unifies SAST, SCA, secrets scanning, and malware protection.Privately held
- SnykSnyk sells the AI Security Platform, which secures the code AI writes, the agents it runs, and the applications it builds.Ownership not established · primary category
- SocketSocket offers a developer-first platform that blocks malicious packages before they reach the code of its users.Ownership not established
- SonatypeSonatype sells software that guides component selection, blocks malicious components and automates dependency fixes in developer and agent workflows.Ownership not established · primary category
- VeracodeVeracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance.Owned by Thoma Bravo since 2019