Software Composition Analysis (SCA) platforms scan an application's open-source dependencies — direct and transitive — to detect known vulnerabilities (CVEs), license risks, and outdated components, and to produce Software Bills of Materials (SBOMs) for supply-chain provenance. Core capabilities include dependency-graph analysis across package managers (npm, Maven, pip, Go modules, NuGet, Cargo), reachability analysis (does the vulnerable function actually get called?), license-compliance checking, SBOM generation in SPDX/CycloneDX formats, automated upgrade pull requests, and continuous monitoring of deployed versions against newly disclosed CVEs. SCA is one of the highest-ROI scans in the DevSecOps stack because open-source code typically constitutes 70–90% of an application. Leading vendors include Snyk Open Source, Sonatype Lifecycle, Mend.io, Black Duck (Synopsys), Dependabot (GitHub), Renovate (Mend), JFrog Xray, Endor Labs, and Chainguard.