Software composition analysis (SCA)
Automated inventory of every piece of third-party code in a product, checked against known vulnerabilities and license terms.
A typical application is 80–90 percent other people's code, and most of it was never chosen by anyone on the team – it arrived as a dependency of a dependency. SCA tools read manifests and lockfiles, sometimes binaries too, build a full list of components and versions, and match it against CVE databases and license catalogues. The output is a vulnerability report and, if you're lucky, a ready-made SBOM.
It started life as a lawyer's tool: in the 2000s Black Duck sold it as a way to find GPL code hiding in proprietary products before an acquisition closed. Security took over after Log4Shell in December 2021, when a lot of organisations couldn't answer the simple question of whether they ran Log4j at all. Dependabot, Snyk and OWASP Dependency-Check are common examples. The weakness is noise: every transitive vulnerability raises an alert, including ones in code that is never called.