Header Navigation
Veracode
Software Composition Analysis
Get the insights you need to protect your organization from open source risks
Accelerating Software Development With
Secure Open Source Libraries
Gaining visibility into your open source risk and exposure reduces the risk of breaches from vulnerabilities. High-performing companies rely on Veracode’s flexible SaaS platform to provide the insights they need to easily identify open source libraries in use, their vulnerabilities, licenses, and risks to their applications – protecting both their applications and their customers’ data through better DevSecOps practices. Veracode Software Composition Analysis (SCA) integrates right into your pipeline for automated scanning and alerts you about defects in your ticketing system.
-
What libraries are we using, and are they safe?
Veracode provides deep insights into the open source libraries used in your applications, complete with versions, licenses, and vulnerabilities present.
-
Are vulnerabilities impacting my code?
For the most popular languages, we are able to map out your application and tell if the vulnerability is specifically impacting your code.
-
Can I react quickly to new vulnerabilities?
From CI integrations to security alerts on new vulnerabilities, Veracode helps you stay on top and get ahead of vulnerabilities.
-
How do I scale my open source risk program?
We are a SaaS-first platform, with years of experience in scaling AppSec programs in every type of development environment.
Find more vulnerabilities, even those undisclosed
The open source movement is growing exponentially, with more than 5 million open source libraries today. Organizations worldwide face a daunting challenge to stay up-to-date with vulnerabilities in these libraries as code changes are made daily. This is made more difficult by the fact that many open source contributors fix vulnerabilities without registering them with the NVD. Veracode crawls open source project repositories to identify these silent fixes. We extract vulnerability information using machine learning models to detect vulnerabilities in open source libraries in near-real time.
Our proprietary database contains:
- All open source vulnerabilities in the National Vulnerability Database (NVD)
- Undisclosed vulnerabilities from open source libraries, found by mining popular repositories and other sources
Check out the Veracode Open Source Vulnerability Database
Learn More
Get continuous visibility into your open source risk
With modern application development processes and frequent releases, your code and risk posture are constantly changing.
Now you can ensure that your applications currently in production are staying protected, even when you’re not actively scanning them.
- Continuous Monitoring: Get alerts about new vulnerabilities in your code, even without a rescan
- Centralized Policy Management and Reporting: View all scan results, manage users, apply policy requirements and make data-driven decisions to proactively manage your risk in the centralized platform
Prioritize vulnerabilities that affect your app and fix them fast
Finding vulnerabilities is only half the challenge in application security. Veracode SCA also provides automated prescriptive fix information, which allows organizations to improve fix rates quickly reduce risk.
- Vulnerable Methods: Identify whether or not the vulnerable code can be exploited by an attacker, allowing you to prioritize fixes based not only on severity but also exploitability
- Automated generation of pull requests: Remediate faster by approving automated code changes
Learn how your apps are using open source libraries
Many solutions on the market today only look at the libraries directly used by your proprietary code. However, dependencies of these libraries can also contain their own vulnerabilities, which expose you to just as much risk.
- Vulnerabilities in transitive dependencies: Detect vulnerabilities not only in direct dependencies but also their dependencies - multiple levels deep
- Stack traces & call graphs: We map your code so you can see all of the libraries, how they’re getting pulled in, and full stack traces of call chains to vulnerable code.
- Container Security: We scan Docker containers and container images to find vulnerabilities associated with open source libraries in Linux distributions and base libraries
- Extensive language/framework support: We support Java, JavaScript, Python, Ruby, PHP, Node.js, Go, Objective C, .NET, C/C++, Swift, and Scala.
- Manage legal risk: Identify open source licenses used by your source code that could introduce legal risks to your business.
Download our SCA Technical Whitepaper
Download
Work with your native development processes and tools
Our agent deploys directly in your pipeline so you can test for security vulnerabilities directly in your CI system.
- CI integration: We integrate with every popular CI and build system: Jenkins, GitLab, Travis, Circle, Gradle, Maven, etc.
- Workflow management: Security defects are automatically tracked in your ticketing system so that security fixes are tracked as part of your sprint.
- Integrated with Veracode Static Analysis: If you are also using Veracode Static Analysis, you can use your existing processes to also scan for open source vulnerabilities, reducing the number of integrations you need to set up and maintain.
Leverage the Veracode Approach to Scale your AppSec Program
Many AppSec programs fail because companies buy tools but they don't have the bandwidth and specialized expertise to manage a program and service developer needs. Veracode SCA is part of the Veracode Platform, Which combines all major application security methodologies under one roof so you can mange risk across your entire application landscape.
- Scan on day one: No hardware to install or manage due to our SaaS-based approach
- Extend your team: Veracode has more than 400,000 hours of program management experience and security expertise
- Unified results: Get visibility into application status across your entire application landscape and all testing types including SCA, SAST, DAST, and MPT in one centralized view
Get A Demo
Cookie Use
We use cookies to collect information to help us personalise your experience and improve the functionality and performance of our site. By continuing to use our site [without first changing your browser setting], you consent to our use of cookies. For more information see our cookies policy.
Veracode is a leading provider of enterprise-class application security, seamlessly integrating agile security solutions for organizations around the globe. In addition to application security services and secure devops services, Veracode provides a full security assessment to ensure your website and applications are secure, and ensures full enterprise data protection. Application protection services from Veracode include white box testing, and mobile application security testing, with customized solutions that eliminate vulnerabilities at all points along the development life cycle.
*Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.