Veracode Software Composition Analysis
By Veracode
Veracode's dependency scanner, sharing a single policy engine and risk dashboard with Veracode Static Analysis so open-source and first-party findings roll up into one score instead of two separate tools with two separate backlogs.
Verified Source: 1
- Product type
- Software
- Deployment
- SaaS
- Organization size
- Mid-marketEnterprise
- Pricing tier
- $$$
Capability checklist
SCAHow Veracode Software Composition Analysis measures up against the full Software Composition Analysis & Supply Chain Security taxonomy.
- Dependency vulnerability scanning — supported
- Flags known CVEs in direct and transitive open-source dependencies.
- License compliance — supported
- Detects and enforces policy on open-source license obligations.
- SBOM generation — supported
- Produces standardized SPDX or CycloneDX software bills of materials.
- Malicious package detection — not supported
- Flags typosquatting and known-malicious packages in the dependency chain.
- CI/CD gating — supported
- Blocks builds or pull requests that introduce new vulnerable or noncompliant packages.
- Reachability analysis — not supported
- Determines whether a vulnerable code path is actually invoked, to cut noise from unused code.
- IaC & container config scanning — not supported
- Scans infrastructure-as-code templates and container configurations for misconfigurations alongside application code.
Alternatives
Other Software Composition Analysis & Supply Chain Security tools with overlapping capabilities, sized for similar teams.