Software composition analysis (SCA) is software that lists every open-source library inside an application, and checks each one against databases of known security flaws and of licences. The list it produces is called a software bill of materials, or SBOM. An SBOM works like the list of ingredients printed on a food packet: it names everything that is inside.
Why is this needed? Most of the code in a modern app was not written by the company that sells the app. Developers import free libraries for common jobs, such as reading dates or sending email, instead of writing that code again. These open-source dependencies make up a large share of every app, and many security flaws arrive through them.
Take, for example, the server code of a lending app in Pune. Its developers chose 25 libraries by name. But each of those libraries uses other libraries, and those use still more. Libraries that arrive this way are called transitive dependencies. So the app actually contains 410 libraries, and the developers chose only 25 of them. SCA reads the files in the code repository that name the chosen libraries, works out the full tree of 410, and writes the SBOM.
Then it checks each library and version. One logging library has a known flaw with a CVE number, the identity number of a flaw in the public catalogue of known software flaws. The flaw is rated critical. SCA reports it and names the version that fixes it. A second library carries a licence that requires any product built on it to publish its own source code when the product is distributed. The lending company does not want that. This is a legal risk rather than a security one.
Older SCA tools report every flawed library. Newer tools also check reachability, which means whether the app's own code ever calls the flawed part of the library. If it does not, the finding can wait. This can cut a list of a thousand findings to a few dozen.
The SBOM matters most on the day a new flaw is announced. In December 2021, a severe flaw was found in Log4j, a logging library used in a very large number of Java programs. Companies that kept SBOMs searched them and knew within hours where they used it. Others spent weeks searching. In India, CERT-In has published guidelines on SBOMs, and SEBI asks the companies it regulates to keep SBOMs for their important software.
SCA usually runs in the CI/CD pipeline on every change, which is shift left security in practice. It sends its findings to application security posture management (ASPM). The company's own code is checked by static application security testing (SAST), and the operating system inside a container by container image scanning.