SOFTWARE COMPOSITION ANALYSIS

SourceSeer SCA

Open-Source Composition Analysis

Identify open-source components and dependencies, assess vulnerability and license risks, and generate SBOMs

COMPOSITION INTELLIGENCEIllustrative workflow

Illustrative workflow: a software project unfolds into components and direct and transitive dependencies. Risk is traced along a dependency path, then recorded with component, dependency and license evidence. Package names and results are illustrative, not live scan results.

Open-source project versions: 390M+
Open-source component versions: 497M+
Open-source components: 26M+
Open-source licenses: 3,100+
Open-source vulnerabilities: 1.16M+

PRODUCT OVERVIEW

From component discovery to ongoing risk management

SourceSeer SCA combines multiple detection technologies with its own analysis engine and open-source knowledge base to identify open-source software assets and assess vulnerabilities and license compliance risks

Continuous vulnerability monitoring, alerts and remediation guidance help enterprises manage open-source risk over time

CORE CAPABILITIES

Core capabilities

04 GROUPS / 08 CAPABILITIES

Open-source component identification

Identify open-source components, versions and dependencies through dependency analysis, file signatures and code snippet fingerprints, and generate SBOMs

In-house code analysis

Use file signatures and code snippet fingerprints to trace code origins and assess the proportion of in-house code across files and code volume

01 / COMPOSITION

SOURCE PROJECTapplicationsrc / manifest

network-kit2.4.0

data-parser1.8.2

core-utils3.1.0

Transitive dependency

runtime-lib1.2.0

Direct dependencies

File & code fingerprints

Open-source originsIn-house code analysis

Conceptual illustration · Not actual scan resultsProduct screenshot

License compliance analysis

Identify declared and embedded open-source licenses, detect license tampering and compatibility conflicts, and provide remediation guidance for internal use and external delivery

Vulnerability noise reduction

Use virtual patch analysis and function call-chain analysis to assess vulnerability impact, reduce alert noise and prioritize remediation

02 / RISK ANALYSIS

01License compliance

Declared licensesEmbedded licenses

Tampering & compatibilityRemediation guidance for use & delivery

02Vulnerability impactAnalysis target

applicationrequest()

data-parserparse()

runtime-libdecode()

Call-chain & virtual patch analysisImpact & priority assessment

Conceptual illustration · Not actual scan results

SBOM management

Manage SBOMs throughout their lifecycle and maintain software asset information for security analysis, compliance reviews and software delivery

Analysis and reporting

Generate security, compliance and in-house code analysis reports in Excel, PDF and DOC, with support for SPDX, CycloneDX and SWID standards to address audit and delivery requirements

03 / SBOM & REPORTING

SOFTWARE ANALYSISSourceSeer SCA

ComponentVersion

network-kit2.4.0

data-parser1.8.2

runtime-lib1.2.0

Maintain asset & analysis data

SBOM

Software bill of materials

SPDX · CycloneDX · SWID

Reports

Security · Compliance · Code origins

Excel · PDF · DOC

Conceptual illustration · Not actual scan results

Threat intelligence

Draw on a continuously updated knowledge base and proprietary intelligence sources to provide vulnerability alerts and track changes in open-source component risk

Enterprise knowledge base

Build an enterprise knowledge base, define component security and compliance policies, manage allowlists and blocklists, and support the implementation of software supply chain admission rules

04 / GOVERNANCE

IntelligenceKnowledge base & proprietary sources

Enterprise policiesAllowlists & blocklists

Software assetsapplication

Risk alertsTrack changes in risk

Admission rulesSupport policy implementation

Conceptual illustration · Not actual scan results

USE CASES

Use cases

01 — 06

Supplier and delivery compliance

Assess suppliers and review software deliveries against component, vulnerability and license requirements, supported by SBOMs and license and copyright notices

Open-source release reviews

Review component origins, software composition, license obligations and security risks before an open-source release to guide remediation

Software provenance and Xinchuang assessment

Use source-code provenance, software similarity analysis and open-source evaluation to support technology independence, control and compliance assessments in Xinchuang projects

Development security governance

Assess risk using deployment context and vulnerability reachability, and support the integration of security checks and governance requirements into development workflows

Software asset and risk management

Maintain a software asset inventory, track vulnerability and compliance risks, and support supplier risk assessment and ongoing software supply chain management

Security readiness reviews

Review risks in critical software using vulnerability intelligence and impact analysis to support security readiness and remediation planning for critical periods

See SourceSeer SCA in action

See how to identify open-source components, check for vulnerabilities and license risks, and generate an SBOM.

Request a Demo