Best Software Composition Analysis Software in 2026 · page 2

Anchore Enterprise

FossID Workbench

FossID Workbench is a software composition analysis tool for identifying and governing third-party components, licenses, and vulnerabilities in codebases.

JFrog Xray

JFrog Xray is a paid software composition analysis tool for finding, prioritizing, and remediating vulnerabilities and license compliance issues in…

MergeBase

OSS Review Toolkit

OSS Review Toolkit (ORT) is a free, open-source toolkit for managing software dependencies and automating FOSS policy checks.

OWASP dep-scan

OWASP dep-scan is a free, MIT-licensed tool that audits software dependencies, container images, and operating systems for known vulnerabilities,…

OWASP Dependency-Track

OWASP Dependency-Track is a free, open-source platform for inventorying software components from SBOMs, identifying vulnerabilities, and enforcing supply-chain policies.

Vulert

OpenHack Supply Chain

Bomly CLI

Bomly CLI scans source trees, SBOMs, Git refs, and container images to build dependency graphs and explain why packages are present.

bundler-audit

CVE Binary Tool

Insignary Clarity

OSV-Scanner

OSV-Scanner is a free tool for finding known vulnerabilities in project dependencies against the OSV database.

Black Duck SCA

Black Duck SCA helps teams manage security, quality, and license compliance risks in open-source and third-party code.

cargo-audit

Clair

Clair is a free, open-source service that scans container images for vulnerabilities in base operating systems, installed packages, and programming language components.

Lineaje SCA360

Lineaje SCA360 is a web-based cloud product for analyzing software supply chain security risks across development stages.

govulncheck

lockhawk

cargo-deny

depproof

pip-audit

Sandworm Audit

SBOM Studio

SBOM Studio is a cloud, web-based enterprise platform for managing software bills of materials and supply-chain risk across a product lifecycle.