software-composition-analysis
(8)
The Security Alert That Never Needed Fixing
Endor Labs built a business around a costly question: does the vulnerable code ever run? As AI agents start writing and installing software, that question has moved from the backlog to the developer’s desk.
The Security Scanner That Wants to Finish the Job
Lineaje began with a small heresy: finding vulnerable code is the easy part. Its larger bet is to trace every ingredient, judge the real risk, and send back a repair that does not wreck the build.
The Package Was Fine Six Minutes Ago
Most security tools ask whether a dependency is already notorious. Socket asks a ruder, more useful question: what will this code do after you invite it inside?
Black Duck Came Back From a $2.1 Billion Detour - Now It Wants to Police the AI Code Rush
The open source scanner sold for $565 million, disappeared inside Synopsys, then returned as the name of a $2.1 billion security business. Its next test is harder: checking code that machines can write faster than humans can review.
Mend.io
Mend.io, formerly WhiteSource, is a Boston- and Tel Aviv-based application security company that helps development and security teams find and fix vulnerabilities in open source dependencies, custom code, and AI-generated code. Its platform spans software composition analysis (SCA), static and dynamic testing (SAST/DAST), API security, automated dependency updates via Renovate, and a growing suite of AI security tools. Serving more than 1,000 customers including a quarter of the Fortune 100, Mend.io emphasizes automated remediation - producing exact code fixes rather than long lists of alerts - to help teams reduce security debt without slowing delivery.
FOSSA
FOSSA is a San Francisco software company that helps engineering, security, and legal teams manage the open source code inside their software. Its platform automates software composition analysis (SCA), open source license compliance, vulnerability management, and Software Bill of Materials (SBOM) generation - scanning packages, containers, binaries, and code snippets on a continuous basis. Founded in 2015 and used by companies such as Uber, Zendesk, Twitter, Verizon, and UiPath, FOSSA aims to let teams ship fast without sacrificing compliance or security.
JFrog
JFrog is the company behind the universal software supply chain platform anchored by Artifactory, the binary repository that lets engineering teams store, secure, and ship every artifact - packages, containers, and now AI models - from a single source of truth. Founded in Israel in 2008 and headquartered in Sunnyvale, California, JFrog (NASDAQ: FROG) serves thousands of enterprises and crossed $531.8 million in revenue in 2025 while pushing its 'Liquid Software' vision of continuous, secure software flow.
Sonatype
Sonatype is the software supply chain management company behind Nexus Repository and the maintainer of Maven Central, the world's largest repository of open source Java components. Founded in 2008 by core contributors to Apache Maven, it helps developers and enterprises find, manage, and secure the open source code that powers modern software - blocking malicious packages, enforcing policy, and generating software bills of materials (SBOMs) across the development lifecycle.