# Software Composition Analysis (SCA)

> Master SCA fundamentals, SBOM generation, and license compliance to secure the software supply chain against vulnerable open-source dependencies.

Canonical: https://codelivly.com/rooms/software-composition-analysis-sca
Last updated: 2026-10-29

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This module transitions you from analyzing custom source code to securing the third-party components that make up modern applications. You will learn the core mechanics of Software Composition Analysis (SCA), including dependency mapping, transitive vulnerability detection, and the generation of Software Bills of Materials (SBOMs). We will cover open-source license compliance, risk management, and the integration of SCA tools into CI/CD pipelines and developer IDEs. The module culminates in a hands-on guided lab where you will analyze an SBOM, identify critical supply chain risks, and implement remediation strategies to secure a modern application's dependency tree.

## Lessons

1. What Is SCA and Why Does It Matter (30 min)
2. CVEs, CVSS and Dependency Trees (30 min)
3. Scanning Dependencies with Trivy & OWASP Dependency-Check (30 min)
4. Automated Dependency Updates (Dependabot, Renovate) (30 min)
5. Guided Lab: Remediating Vulnerable Dependencies in a Pipeline (30 min)

## Related

- [Learning path: Application Security Testing in Pipelines](https://codelivly.com/learning-paths/application-security-testing-in-pipelines)
- [All rooms](https://codelivly.com/rooms)