# DerSecur Software Composition Analysis (SCA) DerSecur Software Composition Analysis (SCA) is a Software Composition Analysis product by DerSecur. It runs in the cloud. Pricing is commercial (contact sales). SCA tool for SBOM generation, dependency analysis, and open-source risk mgmt. Checked October 2026. ## What is DerSecur Software Composition Analysis (SCA)? DerSecur Software Composition Analysis (SCA) is a tool designed to identify and manage risks associated with open-source components and software supply chains. The platform generates Software Bill of Materials (SBOMs) automatically by analyzing uploaded projects, eliminating the need for external SBOM generation tools. The tool provides visibility into third-party components and dependencies through a Dependency Tree Graph that visualizes direct and transitive dependencies, helping identify where vulnerable packages are located within project structures. It tracks open-source packages used across projects and identifies vulnerabilities in third-party components. DerSecur SCA includes a package health scoring system that assesses the security and reliability of open-source projects by combining multiple factors into a single metric. The platform evaluates license compliance of open-source packages to help mitigate legal risks related to licensing. The tool employs a hybrid SCA+SAST analysis approach that combines Software Composition Analysis with Static Application Security Testing to perform vulnerability reachability analysis. This method identifies exploitable CVEs and pinpoints risky method calls to determine actual security risks. DerSecur SCA uses PURL (Package URL) package naming for vulnerability identification and aggregates data from multiple sources including GitHub, GitLab, Google OSV, EPSS, and NIST NVD. The platform provides risk-based prioritization through data-driven health scores to help teams make informed decisions about component usage and remediation efforts. Tags: License Compliance, Open Source, SBOM, Supply Chain Security, Dependency Scanning ## Where it fits in your security program (NIST CSF 2.0) - [Govern](https://cybersectools.com/guides/building-govern-program-small-team): helps you set security rules, owners and oversight. - [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks. ## Quick facts - Category: [Application Security](https://cybersectools.com/categories/application-security) ยท [Software Composition Analysis](https://cybersectools.com/categories/sca) - Vendor: [DerSecur](https://cybersectools.com/companies/dersecur) - Deployment: Cloud - Company size fit: SMB, Mid-Market, Enterprise - Pricing: Contact sales - Features: 10 listed - Integrations: 4 listed - Website: derscanner.com The full feature and integration lists are on the page for signed-in visitors. ## Where it ranks No shortlist covers this product's category yet. The closest is [Best Application Security Solutions for Business](https://cybersectools.com/shortlists/best-application-security-solutions). ## DerSecur Software Composition Analysis (SCA) FAQ ### What is DerSecur Software Composition Analysis (SCA)? DerSecur Software Composition Analysis (SCA) is a product by DerSecur in the Software Composition Analysis category. It covers License Compliance, Open Source and SBOM. ### What is the pricing for DerSecur Software Composition Analysis (SCA)? DerSecur Software Composition Analysis (SCA) is a commercial product. For pricing, visit https://derscanner.com/product/software-composition-analysis-sca/ or contact DerSecur. ### What are alternatives to DerSecur Software Composition Analysis (SCA)? Alternatives to DerSecur Software Composition Analysis (SCA) listed on CybersecTools: 1. [Black Duck SCA](https://cybersectools.com/tools/black-duck-black-duck-sca) - SCA tool for managing security, quality, and license risks in open source code (Commercial) 2. [Cybeats SBOM Studio](https://cybersectools.com/tools/cybeats-sbom-studio) - Enterprise SBOM management platform for software supply chain security. (Commercial) 3. [SOOS SCA](https://cybersectools.com/tools/soos-sca) - SCA tool for detecting OSS vulnerabilities and license risks in dependency trees. (Free) 4. [Snyk Open Source](https://cybersectools.com/tools/snyk-open-source) - SCA tool that finds, prioritizes, and fixes open source vulnerabilities (Commercial) 5. [FossID Software Composition Analysis](https://cybersectools.com/tools/fossid-software-composition-analysis) - SCA tool for code scanning, license identification, and SBOM generation (Commercial) Compare all DerSecur Software Composition Analysis (SCA) alternatives at [https://cybersectools.com/alternatives/dersecur-software-composition-analysis-sca](https://cybersectools.com/alternatives/dersecur-software-composition-analysis-sca) ### What deployment and organization size does DerSecur Software Composition Analysis (SCA) fit? DerSecur Software Composition Analysis (SCA) is available as cloud. It is listed for smb, mid-market and enterprise organizations. Pricing is commercial. Ask DerSecur for pricing and support terms. ## Compare DerSecur Software Composition Analysis (SCA) with similar solutions - [DerSecur Software Composition Analysis (SCA) vs Black Duck SCA](https://cybersectools.com/compare/black-duck-black-duck-sca-vs-dersecur-software-composition-analysis-sca) - [DerSecur Software Composition Analysis (SCA) vs Cybeats SBOM Studio](https://cybersectools.com/compare/cybeats-sbom-studio-vs-dersecur-software-composition-analysis-sca) - [DerSecur Software Composition Analysis (SCA) vs SOOS SCA](https://cybersectools.com/compare/dersecur-software-composition-analysis-sca-vs-soos-sca) All alternatives to DerSecur Software Composition Analysis (SCA): [/alternatives/dersecur-software-composition-analysis-sca](https://cybersectools.com/alternatives/dersecur-software-composition-analysis-sca) --- Source: https://cybersectools.com/tools/dersecur-software-composition-analysis-sca For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL). More on DerSecur Software Composition Analysis (SCA) and DerSecur: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md