Veracode
Software Composition Analysis

Get the insights you need to protect your organization from open source risks

Overview Challenges Vulnerablity Database Continuous Visibility Integrations Get a Demo

Accelerating Software Development With
Secure Open Source Libraries

Gaining visibility into your open source risk and exposure reduces the risk of breaches from vulnerabilities. High-performing companies rely on Veracode’s flexible SaaS platform to provide the insights they need to easily identify open source libraries in use, their vulnerabbilities, licenses, and risks to their applications – protecting both their applications and their customers’ data through better DevSecOps practices. Veracode Software Composition Analysis (SCA) integrates right into your pipeline for automated scanning and alerts you about defects in your ticketing system.

What libraries are we using, and are they safe?

Veracode provides deep insights into the open source libraries used in your applications, complete with versions, licenses, and vulnerabilities present.
Are vulnerabilities impacting my code?

For the most popular languages, we are able to map out your application and tell if the vulnerablility is specifically impacting your code.
Can I react quickly to new vulnerabilities?

From CI integrations to security alerts on new vulnerabilities, Veracode helps you stay on top and get ahead of vulnerabilities.
How do I scale my open source risk program?

We are a SaaS-first platform, with years of experience in scaling AppSec programs in every type of development environment.

Find more vulnerabilities, even those undisclosed

The open source movement is growing exponentially, with more than 5 million open source libraries today. Organizations worldwide face a daunting challenge to stay up-to-date with vulnerabilities in these libraries as code changes are made daily. This is made more difficult by the fact that many open source contributors fix vulnerabilities without registering them with the NVD. Veracode crawls open source project repositories to identify these silent fixes. We extract vulnerability information using machine learning models to detect vulnerabilities in open source libraries in near-real time.

Our proprietary database contains:

All open source vulnerabilities in the National Vulnerability Database (NVD)
Undisclosed vulnerabilties from open source libraries, found by mining popular repositories and other sources

Check out the Veracode Open Source Vulnerability Database
Learn More

Get continuous visibility into your open source risk

With modern application development processes and frequent releases, your code and risk posture are constantly changing.

Now you can ensure that your applications currently in production are staying protected, even when you’re not actively scanning them.

Continuous Monitoring: Get alerts about new vulnerabilities in your code, even without a rescan
Centralized Policy Management and Reporting: View all scan results, manage users, apply policy requirements and make data-driven decisions to proactively manage your risk in the centralized platform

Prioritize vulnerabilities that affect your app and fix them fast

Finding vulnerabilities is only half the challenge in application security. Veracode SCA also provides automated prescriptive fix information, which allows organizations to improve fix rates quickly reduce risk.

Vulnerable Methods: Identify whether or not the vulnerable code can be exploited by an attacker, allowing you to prioritize fixes based not only on severity but also exploitability
Automated generation of pull requests: Remediate faster by approving automated code changes

Learn how your apps are using open source libraries

Many solutions on the market today only look at the libraries directly used by your proprietary code. However, dependencies of these libraries can also contain their own vulnerabilities, which expose you to just as much risk.

Vulnerabilities in transitive dependencies: Detect vulnerabilities not only in direct dependencies but also their dependencies - multiple levels deep
Stack traces & call graphs: We map your code so you can see all of the libraries, how they’re getting pulled in, and full stack traces of call chains to vulnerable code.
Container Security: We scan Docker containers and container images to find vulnerabilities associated with open source libraries in Linux distributions and base libraries
Extensive language/framework support: We support Java, JavaScript, Python, Ruby, PHP, Node.js, Go, Objective C, .NET, C/C++, Swift, and Scala.
Manage legal risk: Identify open source licenses used by your source code that could introduce legal risks to your business.

Download our SCA Technical Whitepaper
Download

Work with your native development processes and tools

Our agent deploys directly in your pipeline so you can test for security vulnerabilities directly in your CI system.

CI integration: We integrate with every popular CI and build system: Jenkins, GitLab, Travis, Circle, Gradle, Maven, etc.
Workflow management: Security defects are automatically tracked in your ticketing system so that security fixes are tracked as part of your sprint.
Integrated with Veracode Static Analysis: If you are also using Veracode Static Analysis, you can use your existing processes to also scan for open source vulnerabilities, reducing the number of integrations you need to set up and maintain.

Leverage the Veracode Approach to Scale your AppSec Program

Many AppSec programs fail because companies buy tools but they don't have the bandwidth and specialized expertise to manage a program and service developer needs. Veracode SCA is part of the Veracode Platform, Which combines all major application security methodologies under one roof so you can mange risk across your entire application landscape.

Scan on day one: No hardware to install or manage due to our SaaS-based approach
Extend your team: Veracode has more than 400,000 hours of program management experience and security expertise
Unified results: Get visibility into application status across your entire application landscape and all testing types including SCA, SAST, DAST, and MPT in one centralized view

Related Resources

Veracode is a leading provider of enterprise-class application security, seamlessly integrating agile security solutions for organizations around the globe. In addition to application security services and secure devops services, Veracode provides a full security assessment to ensure your website and applications are secure, and ensures full enterprise data protection. Application protection services from Veracode include white box testing, and mobile application security testing, with customized solutions that eliminate vulnerabilities at all points along the development life cycle.

*Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Veracode Software Composition Analysis

Accelerating Software Development With Secure Open Source Libraries