Software composition analysis
Identification of open-source and third-party components in software, with their known vulnerabilities and licences.
7 vendors · alphabetical, never ranked
- Black DuckBlack Duck sells a portfolio of application security testing tools covering software composition analysis, static analysis, dynamic testing, and checks aimed at AI-generated code.Owned by Clearlake Capital Group and Francisco Partners since 2024 · primary category
- CheckmarxCheckmarx sells an application security platform combining static and dynamic testing, software composition analysis, secrets detection, and infrastructure-as-code scanning, with a posture-management layer that unifies findings across the tools.Owned by Hellman & Friedman since 2020
- InvictiInvicti sells an application security platform built around dynamic testing of running web applications and APIs, extended with static analysis, open-source dependency scanning, infrastructure-as-code checks, and secrets detection.Ownership not established
- SemgrepSemgrep sells static analysis software that scans source code for security issues, along with tools for open-source dependency and secrets scanning and an AI-assisted layer for detection and remediation.Privately held
- SnykSnyk sells a platform for application security that combines static code analysis, open-source dependency scanning, container and infrastructure-as-code checks, and secrets detection engines, alongside newer tools aimed at code generated by AI assistants and autonomous coding agents.Ownership not established · primary category
- SonatypeSonatype sells software composition analysis and repository management tools that control which open-source components, containers, and AI models developers and AI agents pull into production.Ownership not established · primary category
- VeracodeVeracode sells an application security platform covering static and dynamic testing, software composition analysis, and container and infrastructure-as-code scanning.Owned by Thoma Bravo since 2019
No vendor pays to be listed or to change what we write. Descriptions are ours, drawn from each company's own site and filings. Corrections: /corrections.