software-composition-analysis
Safeguard articles tagged "software-composition-analysis" — guides, analysis, and best practices for software supply chain and application security.
99 articles
Vulnerability Scanner Tools: how they work
A breakdown of how SAST, DAST, SCA, and container vulnerability scanner tools actually work, where Veracode fits, and why false positives remain the industry's biggest problem.
Black Duck and Synopsys: What the Spinoff Means for SCA
Black Duck is now an independent company after splitting from Synopsys in 2024. Here is what changed, and what it means if you rely on it for SCA.
Software Composition Analysis Tools: buyer's checklist
A practical SCA buyer's checklist comparing Safeguard and Black Duck on detection method, CI/CD fit, remediation speed, and license policy enforcement.
SCA language and package manager coverage comparison
See how Safeguard and Black Duck differ on SCA language and package manager coverage, detection methodology, and transitive dependency depth.
How Snyk Container detects application-level dependencies...
A mechanical look at how Snyk Container scans image filesystems to detect npm, pip, Maven, and other application dependencies bundled inside containers.
AppSec program consolidation: reducing tool sprawl
AppSec tool sprawl is a consolidation problem, not just a vendor-count problem. A look at Black Duck's product lineage versus Safeguard's unified scanning pipeline.
How Snyk Open Source builds a full dependency tree from p...
How Snyk Open Source turns package-lock.json and yarn.lock files into a full dependency graph to power vulnerability matching and fix advice.
How Snyk handles Python dependency resolution across pip,...
How Snyk resolves Python dependency trees differently for pip, Poetry, and Pipenv, and what that means for vulnerability scan accuracy.
How Snyk Open Source scans Go modules and resolves the Go...
How Snyk Open Source reads go.mod/go.sum, builds the Go module dependency graph, and uses Minimal Version Selection to identify vulnerable versions.
How snyk monitor creates and tracks a point-in-time proje...
A technical walkthrough of how `snyk monitor` builds a dependency snapshot, stores it as a Project, and re-checks it against new CVEs after the fact.
How Snyk calculates direct versus transitive dependency v...
Snyk splits vulnerability exposure into direct and transitive dependencies using lockfile graphs, CVE version-range matching, and path-level reachability analysis.
How Snyk's reachability analysis determines whether vulne...
A technical walkthrough of how Snyk's reachability analysis builds static call graphs to determine whether vulnerable dependency functions are actually invoked by your code.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.