What is SCA?

Last updated: Oct 21, 2026

Software composition analysis (SCA) is a security technique that automatically identifies the third-party dependencies or libraries that an application uses. SCA also examines the security of these components. These are the benefits of SCA scans:

Vulnerability detection: SCA tools compare the components of your software with large vulnerability databases, for example the National Vulnerability Database (NVD), to find known security flaws. When you use SCA together with static application security testing, you can identify reachable vulnerabilities. A vulnerability is reachable when your software uses the insecure function, method, or element of the dependency.
Software bill of materials (SBOM) generation: SCA tools can automatically make a complete SBOM. The SBOM is a detailed, standard record of all the components and their origins. This record is very important for supply chain risk management and for compliance with the best practices of software development.

The Fluid Attacks SCA scans check if the application complies with these security requirements:

The Fluid Attacks scanner uses reliable sources to get CVEs from published security advisories. Then, the scanner can report these CVEs in the applications that it examines. See the list of these advisory sources.

Fluid Attacks uses many sources. Thus, its AppSec tool has the latest vulnerability data, and you get correct and complete security assessments.

Fluid Attacks updates its database every four hours with the data from the listed sources. Fluid Attacks identifies new CVEs and the affected packages. Then, it finds the groups of its customers that contain those packages and schedules SCA scans for those groups.

Other tools can report more findings for the same codebase. Usually, these tools count one finding for each workspace or manifest file, not one finding for each unique CVE. Fluid Attacks gives priority to actions: one finding, one action.

Fluid Attacks does not examine third-party software components that you copy and paste into your repository. Fluid Attacks reports this bad development practice as "Non-upgradable dependencies" (the code does not use a dependency manager). Fluid Attacks does SCA on the files where you declare the dependencies and finds if vulnerabilities are present and reachable, one by one. The scope of the evaluation includes only the software that you develop. Also, Fluid Attacks SCA is for application security only and detects only security issues. It does not detect other types of issues, for example software quality or legal issues.

To learn more about the Fluid Attacks SCA capabilities, see these resources in this documentation:

Supported package managers, languages and files in SCA: See the complete list of technology that this technique supports.
Configure the tests by the standalone scanner: Do SCA and other techniques with the Fluid Attacks command-line interface (CLI) tools.
Sign up to Fluid Attacks: Start the free trial of SCA and other Fluid Attacks automated techniques. Fluid Attacks configures the scanner for you. The scanner monitors the security of your system continuously while you develop. Fluid Attacks gives you reports, analytics, and remediation suggestions on its platform.
Find reachable dependency vulnerabilities: Learn how to see in the platform which open-source software vulnerabilities your application code uses. Thus, you can focus on real threats.

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, complete this contact form.