Definition
Software Composition Analysis (SCA) is a method for identifying the components, libraries and dependencies used in software to reveal known Vulnerabilities, licence issues and risks associated with their use.
Human Explanation
SCA determines which ready-made components an application uses and whether they contain known security problems.
Why it Matters
Modern software often depends on external components whose condition directly affects the security and maintainability of the complete system.
Conceptual Boundary
SCA does not evaluate the quality of an organisation's own source code. It examines the components and dependencies incorporated into the software.
Practical Perspective
Regular dependency analysis helps teams identify components that require updating, remediation or replacement before known weaknesses are exploited.