SECAI Core · phase 12 of 15 · noun
Software composition analysis
Tools designed to assist with identification of third-party and open-source code during software development and deployment.
The Explain card
- Plain English
- SCA tools identify the third-party and open-source components inside your software during development and deployment, then check them for known vulnerabilities and license issues.
- Example
- An SCA scan of an ML service lists every Python package, flags an outdated serialization library with a known remote code execution flaw, and recommends the patched version.
- Why it matters
- AI stacks pull in hundreds of dependencies, many maintained by small teams. SCA shows defenders what is actually in the build so a single vulnerable library does not compromise the whole model pipeline.
- Hook
- The ingredients list for your code.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
A release pipeline runs software composition analysis against the container image, then blocks deployment when a library matches a critical CVE.
Why these words
- software English compound of soft and ware, modeled on hardware specifies that the phrase concerns computer programs
- composition Latin compositio, putting together focuses attention on the parts assembled into a whole
- analysis Greek analysis, an unfastening or breaking up names the systematic examination applied to that composition
Where it came from
- Origin
- Modern English technical compound formed from software, composition, and analysis
- Entered the language
- c. 2010
- What changed
- Composition moved from general arrangement to the makeup of a software product, while analysis retained its sense of examining something by separating it into parts.
How it is spelled
- Pattern
- The three words remain separate in the phrase.
- Pattern
- Analysis keeps the Greek-derived singular ending -ysis and forms the plural analyses.
- Breaks the pattern
- The plural of analysis is analyses, not analysises.
Spelled like
- catalysis
- paralysis
- electrolysis
Broken into chunks
-
soft
- soften
- softness
-
ware
- hardware
- firmware
-
compos
- compose
- composite
-
analys
- analyze
- analytic
What it sits beside
Same subject
- software bill of materials
- dependency scanning
- vulnerability management
- open-source governance
Same shape
- software dependency analysis
- software architecture analysis
- software risk analysis
application security testing methods
- static application security testing
- dynamic application security testing
- penetration testing
component metadata artifacts
- software bill of materials
- package manifest
- lockfile
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
