Evolution of Software Composition Analysis (SCA) Tools: From Dependency Scanning to Exploitability Analysis

The video examines the evolution of Software Composition Analysis (SCA) tools, highlighting three phases: basic dependency scanning, reachability analysis, and the current era of exploitability analysis. Early SCA tools matched open-source dependencies against databases like the NVD without assessing usage context, leading to false positives. Reachability analysis later determined whether dependencies were used in production or merely for development, refining vulnerability prioritization. The latest advancement, exploitability analysis, leverages AI to evaluate whether reachable vulnerabilities are actually exploitable in a given application, reducing unnecessary alerts. The demonstration uses the Akita dashboard to show how vulnerabilities are downgraded or ignored based on deterministic scans and static reachability checks, with 60 vulnerabilities ignored and 112 downgraded in the example. The tool provides context for each decision, such as a high-severity CVE being reclassified as low due to Drupal’s usage pattern. The goal is to eliminate noise, allowing teams to focus on genuinely exploitable risks while deferring non-critical updates.