# What is Software Composition Analysis (SCA)?

> Software composition analysis identifies software components used in an application and evaluates information associated with them.

- Canonical URL: https://yellowcube.eu/glossary/software-composition-analysis/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It commonly resolves direct and transitive dependencies, component names and versions, licenses, provenance, and matches to published vulnerability records or organization-defined policies. Analysis may use manifests, lockfiles, source trees, package metadata, build outputs, container images, or binary signatures.

The central evidence is component identity, not an analysis of the application’s original code or a live attack. Accurate identification helps teams investigate newly disclosed vulnerabilities, manage unsupported dependencies, review license obligations, and produce or verify software bills of materials. Results need continuing maintenance because dependencies and external intelligence change after release.

### Key points

- **Evidence examined:** Package manifests and locks, dependency graphs, artifact contents, package identifiers, checksums, build metadata, and component databases.
- **Typical outputs:** Component inventory, dependency relationships, version and license information, policy findings, vulnerability matches, and upgrade or remediation candidates.
- **Sound operation:** Scan the artifacts actually built and deployed, include transitive and embedded components, preserve version evidence, update intelligence, and assign owners for remediation decisions.
- **Important limitation:** A component-to-advisory match does not establish that vulnerable code is present, reachable, or exploitable in a particular product. Missing metadata and incorrect version resolution can also create false negatives or positives.

### Related terms

[Software bill of materials (SBOM)](<https://yellowcube.eu/glossary/software-bill-of-materials/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Supply-chain security](<https://yellowcube.eu/glossary/supply-chain-security/>)

### Sources

[OWASP Component Analysis](https://owasp.org/www-community/Component_Analysis) · [NIST SP 800-218, Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.