> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners.md).

# Software Composition Analysis (SCA )

Cortex Cloud Application Security SCA scanners inspect and manage the security and compliance of your application's open-source and third-party dependencies. Securing the supply chain requires aggregating data from all available detection sources. Therefore, SCA in Cortex Cloud relies on both native scanning engines and the direct ingestion of findings from third-party SCA tools such as Snyk or Semgrep. They are part of the Cortex Cloud shift-left security strategy, enabling organizations to proactively identify and mitigate risks associated with external code components early in the development lifecycle.

{% hint style="info" %}

### Important

Utilizing native SCA scanner capabilities requires an AppSec add-on license (Posture Management, Runtime, or Premium Cortex).
{% endhint %}

Currently, native support for SCA is limited to static analysis, meaning that only direct dependencies are scanned. However, if lock files are present, support is extended to include the analysis of transitive dependencies as well. Ingesting third-party data extends this coverage by centralizing your existing external security data into the same platform.

## SCA use cases

SCA provides a comprehensive approach to securing your software supply chain by enabling you to achieve these objectives:

* **Gain comprehensive visibility into Software Composition**: By combining native scans with ingested third-party data, SCA tools build a complete inventory of all open-source packages and their dependencies, providing critical insight into your software's entire composition. This unified view helps you understand and manage your overall software supply chain. Refer to [Software packages as assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/software-packages-as-assets.md) for more information
* **Improve application code security and prioritizing remediation**: SCA scans identify critical vulnerabilities and prioritize remediation efforts based on a data-driven risk assessment that combines code-level vulnerabilities and potential business impact. Normalizing ingested third-party findings alongside native results ensures unified risk prioritization across all detection sources
* **Enable informed decisions about external code**: By providing detailed insights into vulnerabilities and licenses from both native and ingested source, SCA empowers development and security teams to make informed decisions about the use, update, or replacement of external code components

SCA achieves these objectives by performing the following core functions:

* **Identify known vulnerabilities (CVEs)**: Automatically detect and flag known security vulnerabilities (tracked as Common Vulnerabilities and Exposures or CVEs) present in your open-source and third-party dependencies. This provides crucial insights into potential weaknesses that could be exploited
* **Assess license compliance**: Manage open-source license obligations and identify potential compliance risks introduced by your application's components. This helps you adhere to regulatory requirements and minimize legal and compliance exposure
* **Ingest and normalize third-party data**: Aggregate vulnerability data from external SCA vendors. This enables Cortex Cloud to enrich these findings with context to generate issues, allowing you to manage all supply chain risks from a single location


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.