ZeroPath Software Composition Analysis

ZeroPath Software Composition Analysis is a dependency security tool that scans and monitors vulnerabilities across software dependencies. The tool supports over 35 package ecosystems including npm, yarn, pnpm, PyPI, pip, Maven, Gradle, Go Modules, Cargo, crates.io, NuGet, Composer, and Docker/OCI containers.

The product performs exploitability analysis to determine which vulnerabilities are actually used in code based on CVE descriptions, rather than relying solely on reachability analysis. It assigns AI-assessed CVSS 4.0 scores to rank vulnerabilities according to their impact on specific applications.

The tool provides real-time vulnerability monitoring across all supported package ecosystems and generates automated pull requests with updated dependency versions. It exports Software Bill of Materials (SBOM) in CycloneDX format for supply chain security and compliance requirements.

ZeroPath tracks end-of-life components across operating systems (Ubuntu, RHEL, CentOS, Debian, Alpine), languages and runtimes (Python, Node.js, Ruby, Java, PHP, Go, .NET), and frameworks and libraries (Rails, Django, Spring, PostgreSQL, MySQL, Redis, MongoDB). The product monitors deprecation status and provides CVSS 4.0 risk scoring for end-of-life components.

The solution claims to reduce vulnerability noise by 90% through its usage-based risk assessment approach.